rrt/artifacts/exports/rt3-1.06/function-map.csv

1	address	size	name	subsystem	calling_convention	prototype_status	source_tool	confidence	notes	verified_against
2	0x0040a590	892	simulation_service_periodic_boundary_work	simulation	cdecl	inferred	objdump + analysis-context	3	Periodic simulation-maintenance dispatcher inside the world-step family. It switches on the local calendar or phase byte at [this+0x0f] routes one heavy mode through the larger recurring service branch at 0x0040a160 falls back to the simpler one-step advance at 0x00409e80 for other modes and runs several global manager sweeps across 0x0062be10 0x006ceb9c 0x006cfcbc 0x006cec20 and 0x0062bae0 before handing control back to the enclosing stepper. One conditional branch also re-enters shell_map_file_world_bundle_coordinator at 0x00445de0 which keeps the save-or-package family connected to the live simulation cadence.	objdump + analysis-context + caller xrefs
3	0x0040ab50	339	simulation_advance_to_target_calendar_point	simulation	cdecl	inferred	objdump + analysis-context	3	Advances the active world state toward one caller-selected packed calendar target while guarded by the recursion counter at 0x0062b240. The helper compares the current local tuple fields [this+0x0d] [this+0x0f] [this+0x11] and [this+0x14] against a target resolved through 0x0051d550 and 0x0051d5f0 then either recurses in larger 0x168-sized chunks or advances through the smaller periodic step family rooted at 0x00409e80 and 0x0040a9c0. Each successful step notifies the live world root at 0x0062c120 through 0x00450030. Grounded callers include the frame-time accumulator at 0x00439140 the larger fast-forward helper at 0x00437b20 and one shell UI command path.	objdump + analysis-context + caller xrefs
4	0x00434300	881	world_runtime_release_global_services	map	cdecl	inferred	objdump + analysis-context	3	Releases or clears a broad set of world-runtime global services owned by the current map object before a new world entry or sibling save branch continues. The helper walks the owner collection at [this+0x66b2] and then touches many global manager slots including 0x0062b244 0x0062cfcbc 0x0062be10 0x0062c120 0x0062ba8c 0x0062ba88 0x0062b2fc 0x0062b268 0x006cea4c and 0x006acd34 through repeated release-style calls and nulling writes. Current grounded callers are the heavier world-entry branch at 0x00443a50 the sibling .smp world-state branch at 0x00446d40 and shell_transition_mode at 0x00482ec0.	objdump + analysis-context + caller xrefs
5	0x0043cb00	295	world_view_step_heading_quadrant	shell	thiscall	inferred	objdump + caller xrefs	3	Applies one discrete heading-step command to the live world-view owner at 0x0062be68. The helper quantizes the current heading-like field [this+0x10] into one of four wrapped sectors derives the neighboring sector selected by the signed caller step and writes the resulting snapped heading back before rebuilding the dependent view state through 0x0043a750 0x0052d640 and 0x0043bde0. Current grounded callers are the paired shell UI command branches at 0x004de83d and 0x004de857 so this looks like the discrete rotate-view command family rather than free camera drag.	objdump + caller xrefs + callsite inspection
6	0x0043cc30	437	world_view_step_zoom_bucket	shell	thiscall	inferred	objdump + caller xrefs	3	Applies one discrete zoom or view-height bucket step to the live world-view owner at 0x0062be68. It derives a seven-entry threshold table under 0x005ee4dc and 0x0062be4c compares the current view-height field [this+0x18] against those thresholds chooses the neighboring bucket selected by the signed caller step clamps the result into the supported range and then rebuilds the dependent view state through 0x0043c610 0x00439820 and 0x0043bde0. Current grounded callers are the signed shell UI command pair at 0x004de871 and 0x004de88b and the keyboard-owned smoothing branch inside world_view_service_shell_input_pan_and_hover at 0x0043dca4.	objdump + caller xrefs + callsite inspection
7	0x0043d050	111	world_view_set_focus_position_xyz	shell	thiscall	inferred	objdump + caller xrefs	4	Stores one new world-view focus position into the owner at 0x0062be68 by updating [this+0x04] [this+0x08] and [this+0x0c] as the requested X Y and Z coordinates then rebuilding the dependent view state through 0x0043cec0 0x0043a750 0x0052d640 0x00439820 and 0x0043b0e0. The helper also clamps the view-height or distance field at [this+0x18] before recomputing the derived pitch-like field at [this+0x14]. Current grounded callers are the screen-delta wrapper at 0x0043d0c0 the relative pan helper at 0x0043d130 and two larger world-view service branches at 0x0043ee76 and 0x0043f32d.	objdump + caller xrefs
8	0x0043af60	205	world_view_should_drive_primary_pan_channel	shell	thiscall	inferred	objdump	3	Returns whether the world-view owner should drive its primary pan channel on this pass. The predicate first honors the latched override at [this+0xa2] then checks several shell-view gates through 0x00543e00 0x00543e20 and 0x00543e40 on the active controller node plus one optional guard under 0x006d1a8c and the world-mode flag at [0x006cec74+0x120]. When the controller view is active it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as one enabling condition; `shell_input_apply_window_key_transition` grounds those bits as the left and right Shift modifiers from scan codes 0x2a and 0x36 which ties held Shift state back into the same world-view pan family. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and the smaller motion helper at 0x0043e610.	objdump + callsite inspection
9	0x0043b030	173	world_view_should_drive_secondary_pan_channel	shell	thiscall	inferred	objdump	3	Returns whether the world-view owner should drive its secondary pan channel on this pass. Like the neighboring primary predicate it combines shell controller view gates through 0x00543e00 0x00543e20 and 0x00543e40 optional suppression under 0x006d1a8c and one world-mode check at [0x006cec74+0x120]; when the active controller view is present it also treats packed shell input bits 0x3 in 0x006d4018+0xa8c as an enabling condition. Those bits are now grounded as the left and right Shift modifiers from scan codes 0x2a and 0x36 rather than an opaque gameplay-only flag source. Current grounded callers sit in the larger recurring world-view input service at 0x0043db00 and in the smaller motion helpers at 0x0043e610 and 0x0043f4f0.	objdump + callsite inspection
10	0x0043d0c0	111	world_view_apply_screen_delta_to_focus_position	shell	thiscall	inferred	objdump + caller xrefs	4	Converts one screen-relative drag delta into a new world-view focus position and forwards it through world_view_set_focus_position_xyz. When the auxiliary object at [this+0x6e] is live it samples a derived center or height term through 0x00534490 and scales both incoming deltas by the world-view projection constant at 0x005c8700 before calling the lower focus-position setter. The current grounded caller is the cursor-drag helper at 0x00478d31 inside the larger input loop at 0x00478cb0.	objdump + caller xrefs
11	0x0043d130	292	world_view_pan_relative_offset_in_camera_plane	shell	thiscall	inferred	objdump + caller xrefs	4	Applies one local X/Z pan offset to the world-view owner at 0x0062be68 in the current camera plane and forwards the result through world_view_set_focus_position_xyz. The helper derives a scale from the active view-height field [this+0x18] rotates the incoming offset by the current heading-like field [this+0x10] through sine and cosine calls at 0x005a13e4 and 0x005a1494 adds the rotated result onto the current world focus position in [this+0x04] and [this+0x0c] preserves the current Y term in [this+0x08] and then calls the lower focus-position setter. Current grounded callers are the GameUppermost hotspot path at 0x004e094b and the keyboard-owned service branch inside world_view_service_keyboard_turn_and_pan_bindings at 0x0043dae4 which together indicate a shared world-view pan action rather than a separate gameplay command dispatcher.	objdump + caller xrefs
12	0x0043d740	937	world_view_service_keyboard_turn_pan_and_zoom_bindings	shell	thiscall	inferred	objdump + callsite inspection	4	Keyboard-driven world-view interaction helper beneath world_view_service_shell_input_pan_and_hover. It samples elapsed wall-clock time through 0x0051d890 against the previous timestamp at 0x0062be74 clamps the per-pass delta into the 0x08 through 0xc8 range and polls four configurable binding-pair families through the shell input table at 0x006d4018 via 0x0054e7d0. The first two pair families at [this+0x0a6] through [this+0x0b2] and [this+0x0b6] through [this+0x0c2] now ground as the default `Camera Forward` or `Camera Backward` pair and `Camera Left` or `Camera Right` pair. The third family at [this+0x0c6] through [this+0x0d2] produces a signed zoom-step or view-height delta that is returned through the caller-owned out-parameter for later smoothing and grounds as the default `Camera Zoom In` or `Camera Zoom Out` pair, while the fourth family at [this+0x0d6] through [this+0x0e2] applies continuous heading turns through 0x0043c810 and grounds as the default `Camera Rotate Left` or `Camera Rotate Right` pair. When the pan families are active the helper reaches world_view_pan_relative_offset_in_camera_plane at 0x0043d130 after checking the active world-view state. Current grounded caller is world_view_service_shell_input_pan_and_hover at 0x0043db00.	objdump + callsite inspection + caller xrefs + registration xrefs + RT3.lng
13	0x00439e40	557	world_view_seed_keyboard_binding_slot_pairs	shell	thiscall	inferred	objdump + callsite inspection	4	Initializes the eight world-view keyboard binding slot pairs rooted at [this+0x0a6] through [this+0x0e2]. The helper zeroes the paired 4-byte fields then queries the global action-binding registry through 0x0045f370 using eight distinct stub roots at 0x0043d2a0 through 0x0043d310. The registration block at 0x00460769 through 0x004608e7 plus `Data/Language/RT3.lng` show those eight roots are seeded as four labeled directional pairs: `Camera Forward` id 0x0d8a on Up, `Camera Backward` id 0x0d8b on Down, `Camera Left` id 0x0d8c on Left, `Camera Right` id 0x0d8d on Right, `Camera Zoom In` id 0x0d8e on Up, `Camera Zoom Out` id 0x0d8f on Down, `Camera Rotate Left` id 0x0d90 on Left, and `Camera Rotate Right` id 0x0d91 on Right. The first bank feeds the pan pairs later consumed at [this+0x0a6] through [this+0x0c2], while the second bank feeds the zoom-step and heading-turn pairs later consumed at [this+0x0c6] through [this+0x0e2]. After the registry lookups the helper normalizes several legacy companion values across all eight pairs by remapping 0x2 to 0x10 0x20 to 0x12 and 0x4 to 0x11 before storing the results back. This now looks like the live world-view setup path above world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 rather than a separate config-side binding store.	objdump + callsite inspection + callee inspection + registration xrefs + RT3.lng
14	0x0043db00	1968	world_view_service_shell_input_pan_and_hover	shell	thiscall	inferred	objdump + callsite inspection	4	Recurring world-view service that fuses shell input state into the live world-view owner at 0x0062be68. It begins by delegating keyboard-bound turn pan and zoom work to world_view_service_keyboard_turn_pan_and_zoom_bindings at 0x0043d740 then samples controller and view state through 0x00543c50 and 0x00543ba0 caches successive shell input coordinates from 0x006d4018 offsets 0xa94 and 0xa98 derives smoothed cursor or hover deltas against [this+0x2f6] [this+0x2fa] and [this+0x2fe] updates one world-under-cursor cache through 0x00448ac0 and 0x00448bd0 and refreshes the GameUppermost overlay through 0x004e0730 when the pan state changes. The helper repeatedly consults world_view_should_drive_primary_pan_channel at 0x0043af60 and world_view_should_drive_secondary_pan_channel at 0x0043b030 drives one of the lower motion branches at 0x0043e610 0x0043f4f0 or 0x0043e2c0 and smooths the keyboard zoom-step channel through the shared accumulator at 0x0062be78 before issuing discrete view-height bucket steps through world_view_step_zoom_bucket at 0x0043cc30. Current grounded callers include the recurring world-frame path at 0x00439730 and two setup or transition loops at 0x00516859 and 0x00516921. This now looks like the shared shell-input coordinator above keyboard turn pan zoom cursor drag and hotspot world-view motion rather than a mouse-only helper.	objdump + callsite inspection + caller xrefs
15	0x00439140	1086	simulation_frame_accumulate_and_step_world	simulation	cdecl	inferred	objdump + analysis-context	4	Frame-owned simulation cadence after world bring-up and still directly called from shell_service_pump_iteration at 0x00483f70 rather than a separately grounded outer gameplay loop. The routine samples elapsed time through 0x0051d890 mixes shell and mode scalars into a simulation quantum keeps leftover fractional time in [this+0x4c80] and when enough time has accumulated repeatedly calls simulation_advance_to_target_calendar_point at 0x0040ab50 using the current step quantum from 0x005f2b38. Around those simulation steps it refreshes shell-facing presentation helpers under 0x006d4024 and 0x006d0818 updates multiple world collections and transport or scenario side structures and services the recurring GameMessage.win branch through 0x004e0720 before later follow-up work. One deeper world-mode sidecar inside the same frame path now looks grounded too: after delegating to world_view_service_shell_input_pan_and_hover at 0x0043db00 the frame compares the active controller-view pointer at [0x006d4024+0x18]+0x366e against the latched world object at [this+0x66a2], releases the previous object through vtable slot +0x64, and when the new object passes its own availability test at slot +0x1c plus shell-detail control gate 0x07d6 on 0x006d0818 it latches the new object and calls slot +0x60. That makes the frame owner the first grounded non-camera world-input coordinator for hover or focus-target transitions beneath the shell-fed camera stack, even though click or command semantics are still unresolved. This is the strongest grounded owner so far for the recurring gameplay simulation cadence that follows world_entry_transition_and_runtime_bringup.	objdump + analysis-context + caller xrefs + callsite inspection
16	0x00443a50	1073	world_entry_transition_and_runtime_bringup	map	cdecl	inferred	objdump + analysis-context	4	First grounded gameplay-world entry coordinator reached from shell_map_file_entry_coordinator. It stages the selected file path into 0x0062bee0 dismisses the shell detail-panel controller at 0x006d0818 drives shell_transition_mode through 0x00482ec0 and shell_state_service_active_mode_frame then marks shell state for the transition and resets the previous world bundle through world_runtime_release_global_services and the neighboring allocator branch at 0x00438890. After the transition wait it builds temporary bundle payloads from %1\\%2 and %1.tmp allocates or serializes several world-entry records through 0x00530c80 0x00531150 and 0x00531360 allocates the new world root at 0x0062c120 from the staged filename through 0x0044e910 notifies the shell owner at 0x0062be68 and then initializes multiple world-facing global managers including 0x0062ba8c 0x0062b2fc 0x0062b26c and 0x006ada90. This now looks like the first real shell-to-gameplay world-entry bring-up path rather than shell-only staging.	objdump + analysis-context + caller xrefs + strings
17	0x00444dd0	3301	map_bundle_open_reference_databases	map	cdecl	inferred	ghidra-headless	3	Opens and registers a broad reference-database bundle for the active map path. The routine formats %1\\%2 paths allocates bundle state through 0x00530c80 and wires many global datasets including gpdLabelDB gpdCityDB and related city geographic and map reference tables before later shell and map loaders continue.	ghidra + rizin + llvm-objdump + strings
18	0x00445ac0	790	shell_map_file_entry_coordinator	map	cdecl	inferred	objdump + analysis-context	4	Broad shell-side file-open and restore coordinator reached from tutorial launch shell UI editor-panel flows and scenario batch processing. It accepts either an incoming filename seed or a generated Quicksave base name and then chooses between the heavier world-entry branch at 0x00443a50 and the sibling saved-runtime restore branch at 0x00446d40. Bit 0x1 in its flag argument now grounds the Quicksave path from the shared string table at 0x005ca9cc. The non-Quicksave interactive path is tighter now too: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using load mode 4=.gmp when EditorPanel.win is live and the paired non-editor open modes 8=.gms 9=.gmc and 10=.gmx. Current surrounding shell evidence now makes that trio much less anonymous: `.gmx` aligns with sandbox mode because the sibling shell branch at 0x004dc923 gates on 0x006cec7c+0x82 and surfaces string 3898 `The briefing is not available in sandbox games`; `.gmc` aligns with campaign scenarios because 0x004dc9cd gates on 0x006cec7c+0xc5 and surfaces string 3018 about resigning back to the campaign screen; the remaining default `.gms` branch is therefore the standalone scenario family. When a live runtime world is already active the helper appends .smp instead of the non-runtime extensions before the restore branch continues.	objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation
19	0x00445de0	1115	shell_map_file_world_bundle_coordinator	map	cdecl	inferred	objdump + analysis-context	4	Broad shell-side file-save and package coordinator used by direct shell commands scenario batch processing and neighboring shell-editor callers. It accepts either an incoming filename seed a generated Quicksave base name from flag bit 0x1 or the localized `Autosave` seed from flag bit 0x2 string id 387. Its non-Quicksave interactive path is now tighter: it routes through shell_file_request_dialog_collect_target_path at 0x004dd010 using save mode 3=.gmp for the editor-map package path 0=.gms for standalone scenarios 1=.gmc for campaign-scenario saves and 2=.gmx for sandbox saves plus one auxiliary 11=.gmt branch reached only through the separate 0x00434050 check on the side owner at 0x006cd8d8. That `.gmt` path no longer looks like another scenario family: when the auxiliary owner is present the coordinator packages the chosen path into the owner-local request block near 0x006cd8d8+0x8f48 and submits it through 0x00469d30; only when that owner is absent does it fall back to map_bundle_open_reference_databases at 0x00444dd0. The campaign mapping is now backed by the numbered `%s%02d.gmc` helper at 0x00517c70 which formats one campaign-progress slot from 0x006cec7c+0xc4 before re-entering this coordinator, while the sandbox mapping is backed by the neighboring shell restriction string 3898 on 0x006cec7c+0x82. When a live runtime world is active the mainline branch still appends .smp and invokes world_runtime_serialize_smp_bundle at 0x00446240. This makes the helper the save-side sibling of shell_map_file_entry_coordinator rather than another restore dispatcher, with `.gmt` now bounded as an auxiliary preview-surface side path instead of a fourth gameplay save family.	objdump + analysis-context + caller xrefs + strings + mode-table inspection + string correlation + side-owner branch inspection
20	0x00446240	2807	world_runtime_serialize_smp_bundle	map	cdecl	inferred	objdump + analysis-context	3	Serializes the current live world state into the `.smp` branch used by shell_map_file_world_bundle_coordinator. After dismissing the shell detail controller and running one shell-state service step it allocates a bundle through 0x00530c80 seeds many typed records through repeated 0x00531030 and 0x00531340 calls walks world collections under 0x0062c120 and 0x006ada80 and emits runtime-state payloads through helpers such as 0x00534e50 0x00534ec0 0x00534f00 and 0x00534f40 before finalizing through 0x00530a00. Current grounded caller is 0x00445de0 on the `.smp` path so this looks like the live-world save or package serializer rather than the restore path.	objdump + analysis-context + caller xrefs + strings
21	0x00446d40	5401	world_load_saved_runtime_state_bundle	map	cdecl	inferred	objdump + analysis-context	4	Loads one saved runtime world-state bundle from the `.smp` branch selected by shell_map_file_entry_coordinator. The helper dismisses the shell detail controller releases the prior world runtime drives shell mode and status transitions builds a bundle through 0x00530c80 and repeated 0x00531150 reads allocates a new world root at 0x0062c120 through 0x0044cf70 and then fills that root through repeated grid and object writes including 0x0044dca0 0x00448c20 0x00448cb0 0x00448d90 0x00448e60 0x00448e90 and 0x0044de30. This is the first grounded gameplay save-load restore dispatcher for `.smp` content rather than the broader reference-database map-entry flow.	objdump + analysis-context + caller xrefs + strings
22	0x00456920	3247	unit_visual_init_weapon_airframe_and_exhaust_effects	bootstrap	thiscall	inferred	ghidra-headless	4	Initializes one armed-unit visual bundle spanning turret and cannon hardware exhaust emitters and aircraft airframe attachments. The routine creates static Turret Mantlet Cannon and MuzzleFlash assets at [this+0x31a] through [this+0x326] direct JetExhaust and PropExhaust sprite emitters at [this+0x2f6] and [this+0x2fa] a cannon-audio attachment at [this+0x32a] indexed WingL and WingR assets plus plane-audio state at [this+0x32e] through [this+0x346] and cached Aileron Elevator Rudder and Thrust vectors at [this+0x2d1] [this+0x2c5] [this+0x2b9] and [this+0x2dd].	ghidra + rizin + llvm-objdump + strings
23	0x00461650	120	map_load_geographic_label_database	map	cdecl	inferred	ghidra-headless	3	Loads the geographic-label database branch inside the broader reference-bundle setup. It stages resource ids 0x5209 through 0x520b binds the selected bundle through 0x517d90 iterates the loaded collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44 using the current map path context.	ghidra + rizin + llvm-objdump + strings
24	0x00464410	12679	shell_dispatch_ui_command	shell	cdecl	inferred	ghidra-headless	4	Large shell UI command dispatcher reached from shell-side event callbacks and direct command pushes. It switches over many command ids including 0x7530 through 0x7532 graphics-preset commands that route into 0x0051ebc0 0x00484590 and 0x004853c0; 0x7533 through 0x7534 TigerTank viewer actions; and 0x7540 through 0x7543 scenario-text report build and batch-processing commands that route into 0x00489830 0x004886e0 and 0x00489a20.	ghidra + rizin + llvm-objdump + strings
25	0x00474610	120	map_load_city_database	map	cdecl	inferred	ghidra-headless	3	Loads the city database branch in the same pattern as the geographic-label loader. It stages resource ids 0x61a9 through 0x61ab binds the selected bundle through 0x517d90 iterates the collection with 0x517cf0 0x518380 and 0x518140 and dispatches each record through vtable slot +0x44.	ghidra + rizin + llvm-objdump + strings
26	0x00474e20	336	effect_slot_create_attached_sprite_emitter	bootstrap	thiscall	inferred	ghidra-headless	3	Creates or clones one attached sprite emitter for an effect slot on the owning object. Depending on flag bit 0x400 it either clones through 0x00556ce0 or allocates a fresh 0x1fd template through 0x00556920 then attaches the emitter to the owner at [emitter+0x60] and optionally sets persistent flag [emitter+0xbc].	ghidra + rizin + llvm-objdump
27	0x00474f70	97	effect_slot_update_attached_sprite_emitters	bootstrap	thiscall	inferred	ghidra-headless	3	Advances every sprite emitter stored in one effect-slot container by iterating its pointer list and calling 0x00555e50 with update mode zero. When the caller passes null it instead walks the global linked slot list rooted at 0x006cea74.	ghidra + rizin + llvm-objdump
28	0x00478200	291	shell_queue_single_world_anchor_overlay	shell	cdecl	inferred	ghidra-headless	3	Builds one world-anchor overlay packet for the current owner object. It samples the owner transform through 0x00455800 and 0x00455810 derives projected half-height and half-width through 0x00477a10 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and then enqueues the finished marker through shell_queue_world_anchor_marker.	ghidra + rizin + llvm-objdump
29	0x00478330	2432	shell_queue_world_anchor_overlay_list	shell	cdecl	inferred	ghidra-headless	3	Builds and queues a repeated world-anchor overlay list for one owner-managed collection. The routine iterates several owner sublists and state branches repeatedly derives projected extents through 0x00477a10 0x004779c0 world_anchor_measure_projected_half_height and world_anchor_measure_projected_half_width and emits one shell_queue_world_anchor_marker packet per accepted overlay entry.	ghidra + rizin + llvm-objdump
30	0x00483f70	352	shell_service_pump_iteration	shell	thiscall	inferred	objdump + analysis-context	4	Executes one outer shell-service iteration on the shell state rooted at 0x006cec74. The helper can queue service event 0xcc through the shell bundle at 0x006d4018 polls that bundle through 0x00483ea0 refreshes active-mode or shell-state flags ensures the controller work pointer [0x006d4024+0x28] defaults to 0x0062be68 runs several global maintenance helpers and auxiliary cleanup then dispatches shell_state_service_active_mode_frame; when shell-state flag [this+0x501] is set it also marks the controller layout dirty through 0x0051f070 before returning the loop-continue result. bootstrap_init_shell_window_services calls it in the repeating shell loop that appears to own the observed shell lifetime before teardown.	objdump + analysis-context + caller xrefs
31	0x00485750	14	shell_has_tiger_tank_viewer	shell	cdecl	inferred	ghidra-headless	4	Returns whether the dedicated TigerTank shell viewer object at 0x006cfc8c is currently active. The 0x7533 open and 0x7534 close commands both gate on this global before showing status text or mutating viewer state.	ghidra + rizin + llvm-objdump + strings
32	0x004840e0	863	bootstrap_init_shell_window_services	bootstrap	cdecl	inferred	ghidra-headless	4	Consumes the early bootstrap object then allocates and installs the shell service bundle rooted at 0x006d4024 seeds a 640x480 fallback and enters the bootstrap-owned shell loop around shell_service_pump_iteration at 0x00483f70 until shell state [this+0x10] changes; after each break it drives the next shell mode transition through 0x00482ec0 and when the shell lifetime finally ends it tears the shell bundle back down through 0x00521390 before returning to app_bootstrap_main.	ghidra + rizin + llvm-objdump
33	0x00484440	323	app_bootstrap_main	bootstrap	cdecl	inferred	ghidra-headless	4	Primary post-CRT bootstrap coordinator; initializes COM and branding strings probes host state allocates the shell state at 0x006cec74 and then hands shell execution into bootstrap_init_shell_window_services. After that helper returns it releases the shell globals and finishes the remaining process-tail cleanup before exiting back through the CRT.	ghidra + rizin + llvm-objdump
34	0x00484590	887	shell_init_graphics_preset_state	shell	cdecl	inferred	ghidra-headless	3	Initializes the shell graphics-preset state block rooted at [this+0x70]. It clears a large option buffer seeds many default fields and applies one of three coarse mode layouts from its integer argument before later preset application or config-save helpers continue.	ghidra + rizin + llvm-objdump
35	0x00484910	105	shell_save_graphics_config	shell	cdecl	inferred	ghidra-headless	4	Persistently writes the current shell graphics configuration to data\\configuration\\game.cfg. It optionally syncs the global display runtime through 0x0051eea0 then writes config keys 0x429 and 0x48d from the shell state block before closing the file.	ghidra + rizin + llvm-objdump + strings
36	0x00484980	212	shell_load_graphics_config_or_init_defaults	shell	cdecl	inferred	ghidra-headless	4	Loads the shell graphics configuration from data\\configuration\\game.cfg during early shell setup. It optionally pulls the larger display-runtime blob through 0x0051ef20 validates key 0x429 reads key 0x48d into the shell state block at [this+0x70] and falls back to 0x00484590 plus 0x00484910 when the file is missing or invalid.	ghidra + rizin + llvm-objdump + strings
37	0x00484a60	125	shell_match_legacy_gpu_profile_token	shell	cdecl	inferred	ghidra-headless	4	Collects the current display-adapter descriptor string then scans the legacy GPU-profile table at 0x0062142c for the first matching token. The table contains vendor and chipset strings such as geforce radeon Voodoo matrox i810 sis savage and 3dfx; the returned index or -1 then drives the preset-tier tables in 0x004853c0.	ghidra + rizin + llvm-objdump + strings
38	0x00484d70	700	shell_apply_graphics_option_runtime_effects	shell	thiscall	inferred	ghidra-headless	3	Walks the pending graphics-option array rooted at [this+0x1c] and applies runtime side effects for the dirty entries selected by the caller mask. The cases fan into the active engine object at 0x0062c120 and shell globals under 0x006d4024 and 0x006d4030 updating several float scaled thresholds integer quality values and display capability bytes before clearing the dirty array and notifying the active shell object at 0x0062be68.	ghidra + rizin + llvm-objdump
39	0x004852e0	210	shell_apply_default_graphics_master_profile	shell	thiscall	inferred	ghidra-headless	4	Reads the default master graphics profile value from 0x006211dc currently 6 and broadcasts it across option ids 1 through 16 in the shell settings block. Special option ids 10 11 12 and 13 are remapped through the preset tables at 0x00621250 through 0x00621358 before the function refreshes runtime side effects through 0x00484d70 updates shell display-profile flags under 0x006d4024 and persists game.cfg through 0x00484910.	ghidra + rizin + llvm-objdump
40	0x004853c0	740	shell_apply_graphics_preset_bundle	shell	cdecl	inferred	ghidra-headless	4	Applies one table-driven graphics preset bundle to the shell settings object. It derives a preset tier from shell state and runtime capability probes then writes per-setting values through repeated 0x00485060 calls refreshes dependent runtime state through 0x00484d70 optionally saves game.cfg through 0x00484910 and updates several display capability flags under 0x006d4024.	ghidra + rizin + llvm-objdump
41	0x00485060	635	shell_set_graphics_option_with_fanout	shell	thiscall	inferred	ghidra-headless	4	Writes one graphics option value into the shell settings arrays at [this+0xac] and coordinates grouped fanout updates. Primary preset selectors recursively expand into dependent option ids 1 through 16 using preset remap tables at 0x00621250 through 0x00621358. The function compares the new normalized value against the previous setting invokes 0x00484d70 when a runtime refresh is needed and persists game.cfg through 0x00484910 once the update batch completes.	ghidra + rizin + llvm-objdump
42	0x00485760	2746	vehicle_visual_init_running_gear_and_smoke_effects	bootstrap	thiscall	inferred	ghidra-headless	4	Builds a larger vehicle visual bundle covering running-gear assets smoke effects and attachment-audio objects. The routine fills indexed road-wheel visual arrays from RoadWheelR and RoadWheelL asset strings creates direct MuzzleSmoke and ExhaustSmoke sprite emitters at [this+0x216] and [this+0x21a] and then creates five fixed attachment objects at [this+0x3cc] through [this+0x3dc] for diesel1 tracks german88 turret and mantlet audio assets before registering them on the owner.	ghidra + rizin + llvm-objdump + strings
43	0x004883f0	325	scenario_text_export_append_numbered_entry	scenario	cdecl	inferred	ghidra-headless	4	Formats and appends one numbered translation entry into the scenario-text export buffer. It duplicates the source text applies the export wrapper template through helper formatters and appends the finished block through 0x531030 while updating the running non-comment word count at 0x006cfca0.	ghidra + rizin + llvm-objdump + strings
44	0x004886e0	3796	scenario_text_export_build_language_file	scenario	cdecl	inferred	ghidra-headless	4	Builds one MAPS\\%s.lng scenario-text export for the active map and returns the non-comment word count. It writes translator guidance and section headers then walks map briefing territory city geographic-label station company and event collections appending numbered entries through 0x004883f0 before finalizing the output buffer.	ghidra + rizin + llvm-objdump + strings
45	0x00487450	153	shell_open_tiger_tank_viewer	shell	cdecl	inferred	ghidra-headless	3	Allocates and shows the dedicated TigerTank shell viewer object when no viewer is active. It samples shell-owned placement data allocates a 0x434-byte object initializes it through 0x00485760 with the TigerTank title and stores the resulting viewer pointer in 0x006cfc8c.	ghidra + rizin + llvm-objdump + strings
46	0x004874f0	70	shell_close_tiger_tank_viewer	shell	cdecl	inferred	ghidra-headless	4	Closes and frees the dedicated TigerTank shell viewer rooted at 0x006cfc8c. It detaches the viewer if currently selected in the shell owner at 0x0062be68 destroys its internal resources through 0x00530680 frees the object and clears the global viewer slot.	ghidra + rizin + llvm-objdump + strings
47	0x00489830	496	scenario_text_export_report_language_file	scenario	cdecl	inferred	ghidra-headless	3	Opens one existing MAPS\\%s.lng file for the selected map and reports on its parsed contents without rebuilding it. The routine loads the file into memory iterates numbered entries through 0x00488540 formats summary strings through 0x004895c0 and presents success or failure dialogs when interactive mode is enabled.	ghidra + rizin + llvm-objdump + strings
48	0x00489a20	1085	scenario_text_export_batch_process_maps	scenario	cdecl	inferred	ghidra-headless	4	Enumerates maps\\*.gmp and batch-processes every scenario through the scenario-text export branch. Command 0x7542 runs the build path through 0x004886e0 while command 0x7543 runs the report path through 0x00489830; the wrapper tracks progress formats per-map status strings and emits a final summary dialog.	ghidra + rizin + llvm-objdump + strings
49	0x004d4500	88	shell_ensure_editor_panel_window	shell	cdecl	inferred	objdump + analysis-context	4	Ensures the shell-side EditorPanel.win helper window rooted at 0x006d07b4 exists. When the panel is absent it allocates a 0x7c-byte window object seeds the vtable at 0x005d0cb8 binds the EditorPanel.win resource through 0x0053fa50 publishes the object to the shell runtime through 0x00538e50 event 0x1e and then runs the shared panel-open helper at 0x004d4160.	objdump + analysis-context + strings
50	0x004dc670	368	shell_file_options_dialog_construct	shell	thiscall	inferred	objdump + strings	4	Constructs the shared shell file-options dialog rooted at fileopt.win. The helper clears the three downstream branch flags at 0x006d07f8 0x006d07ec and 0x006d07f0 binds the fileopt.win resource through 0x0053fa50 publishes the object to the shell runtime and populates several mode-dependent labels and status text before user input is handled.	objdump + strings
51	0x004dc7f0	477	shell_file_options_dialog_handle_message	shell	thiscall	inferred	objdump + strings	4	Handles the fileopt.win command flow and selects exactly one downstream branch before the shared detail-panel completion dispatcher runs. Successful commands dismiss the dialog then set 0x006d07f8 for the load or restore side 0x006d07ec for the save or package side or 0x006d07f0 for the sibling settings-window escape. The settings branch gates on shell_has_settings_window at 0x004fe120 and lazily opens the shared SettingsWindow.win object through 0x00501e50 while sibling branches show prerequisite dialogs when the requested file operation is not currently allowed.	objdump + strings + caller xrefs
52	0x004dd010	890	shell_file_request_dialog_collect_target_path	shell	cdecl	inferred	objdump + strings	4	Builds the modal filerqst.win request dialog and resolves one chosen target path back into the caller buffer. The helper treats dialog modes 0 1 2 3 and 11 as save-side requests and the paired modes 4 8 9 and 10 as load-side requests then swaps the button and prompt text between localized ids 249 250 and 251 252. On success it appends one extension from the static mode table at 0x005f3d58 where 0 or 8=.gms 1 or 9=.gmc 2 or 10=.gmx 3 or 4=.gmp and 11=.gmt. Current neighboring callers tighten that last mode too: the normal shell map coordinators use the `.gms/.gmc/.gmx/.gmp` families for scenario and editor flows, while save mode 11 is only consumed by the auxiliary `.gmt` preview-surface branch shared with the side owner at 0x006cd8d8. When a live runtime world is already active through 0x004839b0 the helper overrides that non-runtime table and appends .smp instead, which makes it the shared bridge between the broad shell coordinators and the runtime-state serializer or restore path rather than only a generic filename prompt.	objdump + strings + mode-table inspection + caller correlation
53	0x004ddbd0	1096	shell_detail_panel_transition_manager	shell	thiscall	inferred	objdump + analysis-context	3	Transitions the shell detail-panel controller rooted at 0x006d0818 between many window or panel states tracked in [this+0x8c] with optional selection ids cached at [this+0x78] through [this+0x90]. The manager tears down the prior child panel at [this+0x88] through 0x004dd950 updates selector or status UI through 0x004dd410 conditionally opens helper windows such as EditorPanel.win through 0x004d4500 and then allocates one of many shell-facing detail windows including TrainDetail.win TrainList.win and neighboring panel objects before publishing the new child through the shell runtime at 0x006d401c. shell_transition_mode reaches this manager on one branch but the current evidence keeps it on the shell-detail path rather than the first gameplay-world-entry coordinator.	objdump + analysis-context + strings
54	0x004dfdf0	84	shell_ensure_game_message_window	shell	cdecl	inferred	objdump + strings	4	Ensures the standalone GameMessage.win shell object rooted at 0x006d081c exists. When absent it allocates a 0x94-byte window object seeds the vtable at 0x005d0ed0 binds the GameMessage.win resource through 0x0053fa50 stores the result in 0x006d081c and publishes the object to the shell runtime through 0x00538e50.	objdump + strings + caller xrefs
55	0x004e0210	1217	game_message_window_service_frame	shell	thiscall	inferred	objdump + strings	4	Per-frame service pass for the GameMessage.win object rooted at 0x006d081c. It walks up to seven active message or notification records from the collection at 0x006acd34 populates the window slots around ids 0x8ca8 and neighboring controls chooses icon and portrait assets such as Portrait.imb note.imb smiley.imb and smalleye.imb maps selected message records into shell and world collections including 0x006ceb9c 0x0062be10 0x0062b26c and 0x0062bae0 and updates the visible action entries through repeated 0x00540120 calls. Current grounded caller is the simulation frame path through 0x004e0720.	objdump + strings + caller xrefs
56	0x004e0720	15	game_message_window_service_if_present	shell	cdecl	inferred	objdump + caller xrefs	4	Services the GameMessage.win branch only when the global object at 0x006d081c is live by tail-calling game_message_window_service_frame. The current grounded caller is simulation_frame_accumulate_and_step_world which keeps this world-facing message overlay inside the shell-owned recurring frame cadence.	objdump + caller xrefs
57	0x004e0780	468	game_uppermost_window_service_world_hotspot_band	shell	thiscall	inferred	objdump + strings + caller xrefs	4	Per-frame world-facing hotspot service for the GameUppermost.win overlay rooted at 0x006d0820. The helper clears the previously latched hotspot id at [this+0x78] when the shell runtime selection changes then requires an active world-mode branch at [0x006cec74+0x114] a live shell runtime node at [0x006d401c+0xc6d] an unobscured controller view through 0x00543e20 and 0x00543e40 and one selected control id in the narrow band 0x7918 through 0x7921. It rate-limits repeats through the runtime timestamp at [selected+0xd2] remaps the two rightmost ids onto the sibling left-side base actions 0x791c and 0x791e rechecks shell_input_cursor_inside_active_view at 0x0054f540 scales one table-driven coordinate pair from 0x006066c8 and 0x006066e8 and finally pushes that world-relative offset into the live world owner at 0x0062be68 through 0x0043d130. Current grounded caller is game_uppermost_window_handle_message at 0x004e0ba0.	objdump + strings + caller xrefs
58	0x004e0960	432	game_uppermost_window_refresh_controls	shell	thiscall	inferred	objdump + strings + caller xrefs	4	Refreshes the visible control state for the GameUppermost.win overlay at 0x006d0820. The helper repopulates the hotspot control band 0x7918 through 0x7921 through repeated 0x00540120 calls chooses one of two layout or visibility selectors based on the active world-mode state under 0x006cec74 and resolves the localized label `Hide Bottom Interface (Toggle)` for control 0x7923 before publishing it back into the window tree. Grounded callers include the overlay constructor at 0x004e0b20 the overlay message handler at 0x004e0ba0 and a later world-mode state-change branch at 0x004ff3f5.	objdump + strings + caller xrefs
59	0x004e0b20	118	game_uppermost_window_construct	shell	thiscall	inferred	objdump + strings + caller xrefs	4	Constructs the GameUppermost.win overlay object later stored at 0x006d0820. The helper seeds the vtable at 0x005d0f3c binds the GameUppermost.win resource through 0x0053fa50 registers the shared control callback at 0x004e0a70 for ids 0x7918 through 0x7921 refreshes the initial control state through game_uppermost_window_refresh_controls and initializes sibling control 0x7922 before returning the live overlay object. The ensure helper at 0x004e0e40 is the current grounded caller.	objdump + strings + caller xrefs
60	0x004e0ba0	95	game_uppermost_window_handle_message	shell	thiscall	inferred	objdump + strings + caller xrefs	4	Message dispatcher for the GameUppermost.win overlay object. It seeds one visual-speed field on the command object returned by 0x0053f830 then switches on the incoming message id through the local jump table at 0x004e0d04. The current grounded cases call game_uppermost_window_service_world_hotspot_band during the recurring service path refresh the overlay controls through game_uppermost_window_refresh_controls on a sibling state-change path and route control 0x7922 into the world-mode toggle helper at 0x004349f0 which also updates the same overlay object at 0x006d0820.	objdump + strings + caller xrefs
61	0x004e0e40	75	shell_ensure_game_uppermost_window	shell	cdecl	inferred	objdump + strings + caller xrefs	4	Ensures the world-facing GameUppermost.win overlay rooted at 0x006d0820 exists. When absent it allocates a 0xae-byte window object constructs it through game_uppermost_window_construct at 0x004e0b20 stores the result globally and publishes it through the shell runtime at 0x006d401c via 0x00538e50. A grounded caller sits in the shell_transition_mode path near 0x004831c0 immediately after the GameMessage.win bring-up branch which ties this overlay to world-mode entry rather than generic shell UI.	objdump + strings + caller xrefs
62	0x004fe120	14	shell_has_settings_window	shell	cdecl	inferred	objdump	4	Returns whether the shared settings window object rooted at 0x006d1350 is currently live. The fileopt settings escape branch and direct shell command wrappers both gate on this before opening SettingsWindow.win again.	objdump + caller xrefs
63	0x00500640	487	shell_settings_window_construct	shell	thiscall	inferred	objdump + strings	4	Constructs the shared SettingsWindow.win object later stored at 0x006d1350. The helper binds the SettingsWindow.win resource through 0x0053fa50 allocates a page-selection helper at 0x006d1358 walks the 13-entry category table rooted at 0x00622870 and populates the resulting shell control tree with the page labels and ordering data before the window is shown.	objdump + strings
64	0x00501e50	201	shell_open_settings_window	shell	cdecl	inferred	objdump + strings	4	Lazily allocates and shows the shared SettingsWindow.win shell object at 0x006d1350. When no settings window is live it allocates a 0x78-byte object constructs it through shell_settings_window_construct publishes it to the shell runtime through 0x00538f10 and then notifies the active shell owner at 0x0062be68. Current grounded callers are the direct shell command wrapper at 0x00482b00 the fileopt settings escape branch and one larger shell UI dispatcher branch near 0x0050366a.	objdump + strings + caller xrefs
65	0x00468d00	222	multiplayer_update_semicolon_name_list	shell	cdecl	inferred	ghidra-headless	4	Adds or removes one player-name token in the semicolon-delimited moderation list rooted at `[ecx+0x905c]`. With mode `1` it appends the supplied token only when not already present writing `;` as the delimiter; with mode `0` it removes the matched token collapses the remainder left and skips an adjacent delimiter when present.	ghidra + rizin + llvm-objdump + strings
66	0x00468de0	14	multiplayer_session_event_forward_action1_request	shell	unknown	inferred	ghidra-headless	2	Session-event callback wrapper that always forwards request id `1` through multiplayer_set_pending_session_substate with a zero auxiliary payload. The callback clears EDX before the shared setter call and currently lands on a request id that does not yet map to a visible pending substate so this row remains structural.	ghidra + rizin + llvm-objdump
67	0x00468e00	188	multiplayer_session_event_publish_pair_chat_template	shell	unknown	inferred	ghidra-headless	3	Session-event callback that formats one two-string chat/status line through multiplayer_route_chat_line when the callback status in EDX is zero and the current live session count is not positive. A selector near `[esp+0x214]` chooses the template `%s* %s` `%s %s` or `%s > %s`; the helper length-checks both inputs against the local 0x1f4-byte buffer before formatting and returns without publishing when either string is null or too long.	ghidra + rizin + llvm-objdump + strings
68	0x00468ec0	144	multiplayer_session_event_publish_action2_single_name	shell	unknown	inferred	ghidra-headless	3	Session-event callback wrapper for the one-name action-2 status path. When the callback status in EDX is zero and the current session count is positive it length-checks the supplied name formats localized text id `0xb73` routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with that same name payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.	ghidra + rizin + llvm-objdump
69	0x00468f50	192	multiplayer_session_event_publish_action2_pair	shell	unknown	inferred	ghidra-headless	3	Session-event callback wrapper for the two-string action-2 status path. When the callback status in EDX is zero and the supplied name lengths fit within the local buffer it formats localized text id `0xb74` or `0xe34` depending on whether the first string is present routes the resulting line through multiplayer_route_chat_line and then forwards request id `2` through multiplayer_set_pending_session_substate with the second string as the target payload and the first string as the auxiliary payload. The currently grounded setter does not visibly store a pending substate for id `2` so this row stays partly structural.	ghidra + rizin + llvm-objdump
70	0x00469010	30	multiplayer_session_event_forward_action4_request	shell	unknown	inferred	ghidra-headless	3	Session-event callback wrapper that forwards request id `4` only when both supplied payload pointers are non-null. It passes the second stack argument as the action payload and a zero auxiliary argument through multiplayer_set_pending_session_substate. The currently grounded setter does not visibly store a pending substate for id `4` so this row remains structural.	ghidra + rizin + llvm-objdump
71	0x00469030	30	multiplayer_session_event_forward_action7_request	shell	unknown	inferred	ghidra-headless	2	Session-event callback wrapper that forwards one payload pointer through multiplayer_set_pending_session_substate with request id `7` when the callback status in EDX is nonzero. The wrapper normalizes its incoming pointer into the second stack slot before tail-calling the shared setter but the currently grounded setter does not map request id `7` to a visible pending substate so this row remains structural.	ghidra + rizin + llvm-objdump
72	0x00469060	3	multiplayer_session_event_noop_12byte_stub	shell	unknown	inferred	ghidra-headless	4	Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 0xc` and does not touch any state.	ghidra + rizin + llvm-objdump
73	0x00469070	87	multiplayer_session_event_publish_status_value	shell	unknown	inferred	ghidra-headless	3	Session-event callback that publishes one status value into the destination text builder passed in the third stack argument. It first compares the supplied index against the live session count from `0x006d40d0`; out-of-range entries publish the fixed fallback text at `0x005c87a8`; in-range entries publish integer `100` through 0x0058cd40 when event code EDX is `0x18`; publish the string at `0x00521d40+0x08` when EDX is `0x15`; and otherwise fall back to the same fixed text token.	ghidra + rizin + llvm-objdump + strings
74	0x004690d0	15	multiplayer_session_event_publish_fixed_status_text	shell	unknown	inferred	ghidra-headless	3	Session-event callback that appends the fixed status text token at `0x005c87a8` into the destination text builder passed in the second stack argument. This is the smallest text-publisher sibling in the same callback family and shares the same append helper 0x0058bce0 used by 0x00469070.	ghidra + rizin + llvm-objdump
75	0x004690f0	106	multiplayer_session_event_seed_control_id_list	shell	unknown	inferred	ghidra-headless	3	Session-event callback that seeds a byte-list builder with the fixed control-id set `3 1 8 10 11 19 4 5` when the callback status in EDX is zero. It appends each id through 0x0058bcb0 into the destination builder passed in the first stack argument and returns immediately when the callback status is nonzero.	ghidra + rizin + llvm-objdump
76	0x00469160	26	multiplayer_session_event_query_session_count	shell	unknown	inferred	ghidra-headless	4	Session-event callback helper that returns the live session count from `0x006d40d0` through 0x00521670 only when the callback mode in EDX equals `1`; all other modes return zero. This looks like the count-query slot in the same registration table.	ghidra + rizin + llvm-objdump
77	0x00469180	3	multiplayer_session_event_noop_8byte_stub	shell	unknown	inferred	ghidra-headless	4	Three-byte no-op callback stub in the Multiplayer.win session-event registration table. It returns immediately with `ret 8` and does not touch any state.	ghidra + rizin + llvm-objdump
78	0x00469190	8	multiplayer_session_event_latch_status_code	shell	unknown	inferred	ghidra-headless	4	Small session-event callback helper that stores the incoming status code from EDX into `0x006cd974` and returns. The registration branch later clears the same global before transport teardown or retry reset.	ghidra + rizin + llvm-objdump
79	0x004691a0	45	multiplayer_session_event_notify_owner_and_queue_action8	shell	unknown	inferred	ghidra-headless	3	Session-event callback wrapper that first notifies the current Multiplayer.win owner through multiplayer_notify_window_owner. When the callback status in EDX is zero it then queues request id `8` through multiplayer_set_pending_session_substate with the same payload pointer; otherwise it returns after the owner notification only.	ghidra + rizin + llvm-objdump
80	0x004691d0	39	multiplayer_find_session_event_capacity_entry	shell	unknown	inferred	ghidra-headless	4	Scans the fixed 0x80-entry session-event capacity array for a live record owned by the supplied key pointer in EDX. Each 0x11c-byte record is live when [entry+0x104] is nonzero and a match requires [entry+0x10c] to equal the incoming key. The helper returns the matched entry pointer or null.	ghidra + rizin + llvm-objdump
81	0x00469200	428	multiplayer_sync_session_event_capacity_entry	shell	unknown	inferred	ghidra-headless	3	Session-event cache-field callback that creates updates or clears one cached capacity record for the supplied owner key. Mode `0` creates the first free 0x11c-byte record when none exists mode `1` updates an existing record and mode `2` clears an existing record by zeroing [entry+0x104]. The create and update paths store the owner key at [entry+0x10c] seed [entry+0x104] with 0x2328 resolve `numplayers` and `maxplayers` handles through 0x0058d6d0 and copy the current display string into [entry+0x84].	ghidra + rizin + llvm-objdump + strings
82	0x004693b0	80	multiplayer_session_event_cache_line_callback	shell	unknown	inferred	ghidra-headless	4	Transport-side callback that appends one incoming status line into the cached session-event line store at `0x006ae4d8`. When the callback status in EDX is nonzero and the incoming line pointer is valid it copies the string from the third stack argument into slot `0x006cd97c << 8` subject to the `0x1f4` entry cap and a small flag filter on the fourth stack argument then increments `0x006cd97c` for later iteration.	ghidra + rizin + llvm-objdump
83	0x00469410	56	multiplayer_init_session_event_transport_state	shell	unknown	inferred	ghidra-headless	3	Initializes the Multiplayer.win session-event transport state rooted at `0x006cd970`. The helper latches the incoming mode or state into `0x006cd978`; when that value is nonzero it zeroes the large scratch block at `0x006ae4d8` resets `0x006cd97c` and registers the cached-line callback block rooted at `0x004693b0` through multiplayer_transport_register_selector_callback before returning.	ghidra + rizin + llvm-objdump
84	0x00469450	97	multiplayer_teardown_session_event_transport	shell	unknown	inferred	ghidra-headless	3	Tears down the active session-event transport object at `0x006cd970`. When the latched mode at `0x006cd978` is nonzero and the multiplayer session object at `0x006cd920` exists it first switches the transport back to status route `0` through multiplayer_transport_select_status_route clears the status pump through multiplayer_transport_clear_status_pump disconnects through multiplayer_transport_disconnect shuts the object down through multiplayer_transport_shutdown and finally clears `0x006cd970`.	ghidra + rizin + llvm-objdump
85	0x004694c0	57	multiplayer_publish_session_event_fixed_token	shell	unknown	inferred	ghidra-headless	3	Small session-event transport helper that publishes one fixed token through the active transport object when the latched mode and multiplayer session object are both present. It first switches the transport to status route `1` through multiplayer_transport_select_status_route and then sends the fixed token at `0x005c87a8` plus flag `1` through multiplayer_transport_publish_fixed_token_message. The current grounded caller is the Multiplayer.win branch at `0x0046c3c0`.	ghidra + rizin + llvm-objdump + strings
86	0x00469500	27	multiplayer_flush_session_event_transport	shell	unknown	inferred	ghidra-headless	3	Lightweight session-event transport flush wrapper. When the active transport object at `0x006cd970` exists it first forces a status flush through multiplayer_transport_force_status_flush and then tail-calls multiplayer_transport_flush_and_maybe_shutdown on that same object.	ghidra + rizin + llvm-objdump
87	0x00469520	94	multiplayer_register_session_event_cache_fields	shell	unknown	inferred	ghidra-headless	3	Registers the session-event cache-field subscription set for the active Multiplayer.win object. When no multiplayer session object is present it marks `[this+0x8f18]` armed and subscribes callback `0x00469200` through multiplayer_transport_subscribe_field_callback_set with the fixed field-id list `3 1 4 8 10 11 19 5` rooted at `[this+0x10]`.	ghidra + rizin + llvm-objdump
88	0x00469580	65	multiplayer_begin_session_event_line_iteration	shell	unknown	inferred	ghidra-headless	4	Primes iteration over the cached session-event line store at `0x006ae4d8`. When the multiplayer session object at `0x006cd920` is absent it sets `[this+0x9874]` armed clears the cached line slots and line index at `0x006cd97c` and re-registers the line callback `0x004693b0` through multiplayer_transport_register_selector_callback before returning.	ghidra + rizin + llvm-objdump
89	0x004695d0	66	multiplayer_next_session_event_cached_line	shell	unknown	inferred	ghidra-headless	4	Returns the next non-empty cached session-event line from the fixed store at `0x006ae4d8`. On first use after multiplayer_begin_session_event_line_iteration it resets `0x006cd97c` and clears `[this+0x9874]`; afterwards it returns the current 0x100-byte slot pointer when the first byte is nonzero and advances `0x006cd97c` or returns null when no further cached lines remain.	ghidra + rizin + llvm-objdump
90	0x00469620	52	multiplayer_submit_owner_notified_session_event_text	shell	unknown	inferred	ghidra-headless	3	Submits one caller-supplied text buffer through the active session-event transport using callback multiplayer_session_event_notify_owner_and_queue_action8. The helper first sanitizes the input string into a local 0x100-byte transport record through multiplayer_transport_sanitize_identifier and then forwards that record through multiplayer_transport_submit_text_record with fixed mode arguments `0` and `1`.	ghidra + rizin + llvm-objdump
91	0x00469660	27	multiplayer_send_session_event_text_selector0	shell	unknown	inferred	ghidra-headless	3	Thin session-event transport wrapper that sends one caller-supplied text pointer through multiplayer_transport_send_selector_text with selector `0` when the pointer is non-null. The current grounded caller is the Multiplayer.win control dispatcher around `0x00469d30`.	ghidra + rizin + llvm-objdump
92	0x00469680	14	multiplayer_pump_session_event_status	shell	unknown	inferred	ghidra-headless	3	Thin session-event transport wrapper that immediately requests a status pump through multiplayer_transport_request_status_pump on the active transport object at `0x006cd970` and discards one stack argument. Current grounded callers use it after updating Multiplayer.win status text ids `0xe60` and `0xe61`.	ghidra + rizin + llvm-objdump
93	0x00469700	27	multiplayer_preview_dataset_stage_selected_path	shell	thiscall	inferred	objdump + caller xrefs	3	Small Multiplayer preview-dataset helper that copies one caller-supplied selected path string into the dataset-local staging buffer at `[this+0x8f48]`. Current grounded callers feed it the active session-entry path from the live session list before later preview or launch-side dataset work.	objdump + caller xrefs
94	0x00469720	221	multiplayer_preview_dataset_service_frame	shell	thiscall	inferred	objdump + caller xrefs	3	Recurring shell-frame service for the Multiplayer preview dataset rooted at `0x006cd8d8`. When the gating global at `0x006cd910` and the dataset render target at `[this+0x9884]` are live it walks the active session list under `0x006d40d0`, formats one roster or status line per entry through the template at `0x005ce1ac`, and then pushes the accumulated text through the render/update helper at `0x005519f0` with fixed presentation parameters. The current grounded caller is `shell_state_service_active_mode_frame`, which makes this a shell-owned per-frame refresh path for multiplayer preview text rather than a transport I/O loop.	objdump + caller xrefs + strings
95	0x0046a6c0	307	multiplayer_session_event_publish_registration_field	shell	unknown	inferred	ghidra-headless	3	Switch-driven session-event callback that publishes one Multiplayer.win registration/status field into the destination builder passed on the stack. Depending on selector EDX it emits the local session name from `0x006cec74` the profile text at `0x006cd8d8+0x8e10` the constant `0x2328` the live session count from `0x006d40d0` the field at `[0x006d1270+0x3b6]` the active profile string at `[0x006cec7c+0x44]` or fixed strings such as `Initializing...` `openstaging` and `closedplaying`; unsupported selectors fall back to the fixed token at `0x005c87a8`.	ghidra + rizin + llvm-objdump + strings
96	0x0046a830	194	multiplayer_session_event_retry_with_random_player_name	shell	unknown	inferred	ghidra-headless	3	Registration-side callback that increments the retry counter at `0x006cd984` and on early retries formats a randomized `RT3Player%d` name into `0x006ae0c0` sanitizes it into a local notification object notifies the current Multiplayer.win owner and forwards that object through multiplayer_transport_set_local_name. On the first retry it also routes request id `5` or `6` through multiplayer_set_pending_session_substate depending on the incoming status flag; after 25 retries it resets `0x006cd984` and `0x006cd974` and calls multiplayer_transport_reset_and_maybe_shutdown instead.	ghidra + rizin + llvm-objdump + strings
97	0x0046a900	522	multiplayer_register_session_event_callbacks	shell	thiscall	inferred	ghidra-headless	4	Builds and registers the Multiplayer.win session-event callback table rooted at the local block on `[esp+0x28]`. The function seeds slots with multiplayer_session_event_forward_action1_request multiplayer_session_event_publish_pair_chat_template multiplayer_session_event_publish_action2_single_name multiplayer_session_event_publish_action2_pair multiplayer_session_event_forward_action4_request multiplayer_session_event_forward_action7_request multiplayer_session_event_noop_12byte_stub multiplayer_session_event_publish_registration_field multiplayer_session_event_publish_status_value multiplayer_session_event_publish_fixed_status_text multiplayer_session_event_seed_control_id_list multiplayer_session_event_query_session_count multiplayer_session_event_noop_8byte_stub multiplayer_session_event_latch_status_code multiplayer_session_event_notify_owner_and_queue_action8 multiplayer_init_session_event_transport_state and multiplayer_session_event_retry_with_random_player_name. It allocates the transport callback object under `0x006cd970` stages the session name into the local descriptor block and then finishes registration through multiplayer_transport_register_callback_table which in turn routes through multiplayer_transport_attach_callback_table_descriptor multiplayer_transport_enqueue_descriptor_block_record and multiplayer_transport_dispatch_callback_table_binding.	ghidra + rizin + llvm-objdump + strings
98	0x0046c360	32	multiplayer_route_chat_line	shell	cdecl	inferred	ghidra-headless	3	Routes one multiplayer chat line through the active transport object at `0x006cec78` when present or falls back to the local Multiplayer.win chat publisher otherwise. The transport path forwards the supplied text into 0x4554e0 with fixed mode arguments `5 1 0`; the local fallback tail-calls multiplayer_publish_wrapped_chat_message.	ghidra + rizin + llvm-objdump
99	0x0046f960	2209	multiplayer_dispatch_chat_command	shell	cdecl	inferred	ghidra-headless	4	Parses and dispatches one slash-prefixed Multiplayer.win chat command line from `[eax+0x08]`. The parser normalizes `/` to `\\` and handles the grounded command family `\\kick` `\\clear` `\\whois` `\\me` `\\unban` `\\ban` `\\snore` `\\sneeze` `\\hurry` `\\trackisfree` `\\loadgame` and `\\sendgame`. The strongest branches are now clear: `\\kick` resolves a typed peer name through the active session tables and forwards the resulting peer object through multiplayer_request_peer_session_control when the target is neither null nor the local player; `\\clear` clears the local chat pane through multiplayer_publish_wrapped_chat_message(null); `\\whois` finds a named peer and emits multi-line `%s Ip = %s` `Cpu` `Game` and `Build Time` diagnostics through multiplayer_route_chat_line; `\\ban` and `\\unban` resolve either a dotted player name or the selected peer name then update the semicolon-delimited moderation list through multiplayer_update_semicolon_name_list with add/remove modes while `\\unban` can also forward a live peer object through multiplayer_request_peer_session_control; `\\snore` `\\sneeze` and `\\hurry` build transient presentation objects then broadcast text ids `0xb79` `0xb7a` and `0xb7b`; `\\loadgame` copies the requested filename into `0x006ce630` and arms flag `0x006ce9bc`; `\\trackisfree` arms flag `0x006ce9b4`; and `\\sendgame` allocates one 0x5c-byte transfer record under `0x006ce290` for the chosen player slot. The parser returns `1` only when a command branch handled the line and otherwise leaves the caller to treat it as ordinary chat text.	ghidra + rizin + llvm-objdump + strings
100	0x00470210	119	multiplayer_submit_chat_or_command_line	shell	cdecl	inferred	ghidra-headless	4	Submits one Multiplayer.win chat-entry line. The wrapper first calls multiplayer_dispatch_chat_command on the raw line buffer; when the parser returns zero it formats a normal `%s > %s` named chat line from the sender object at `[edi+0x08]` and the message payload; then either publishes it locally through multiplayer_publish_wrapped_chat_message or routes it through the active transport object at `0x006cec78`. When the parser returns nonzero the wrapper skips normal chat formatting because the slash-command branch already consumed the line.	ghidra + rizin + llvm-objdump + strings
101	0x004ecc90	52	multiplayer_set_pending_session_substate	shell	unknown	inferred	ghidra-headless	2	Small pending-session-substate setter used by the multiplayer session-event callback family. The grounded stores are request id `5` to substate `5` request id `6` to substate `6` and request id `8` to substate `8` at `0x006d1288`. Other current callback-family callers still pass ids `1` `2` `4` and `7` without a visible store in this helper so this row stays structural for now.	ghidra + rizin + llvm-objdump
102	0x004edce0	19	multiplayer_notify_window_owner	shell	unknown	inferred	ghidra-headless	3	Thin Multiplayer.win owner-notification wrapper. It loads the current window owner singleton from `0x006d1268` and when present forwards the supplied payload pointer into 0x004eccd0 for owner-side handling; current grounded callers are the session-event callback family around 0x004691a0 and the related registration path near 0x0046a8b3.	ghidra + rizin + llvm-objdump
103	0x004ecb20	101	multiplayer_reset_local_session_slot_state	shell	cdecl	inferred	ghidra-headless	4	Resets the local Multiplayer.win session-slot state before window init or add-open-slot flows. The helper marks the local state at `0x006cec7c+0x97` initialized clears the local slot counters at `+0x79` and `+0x7b` zeroes the slot-marker bytes at `+0x87` clears the local summary block at `+0x44` and zero-fills the large session backing block at `0x006d1270` when present.	ghidra + rizin + llvm-objdump
104	0x004ecb90	191	multiplayer_probe_or_allocate_open_player_slot	shell	cdecl	inferred	ghidra-headless	3	Probes or allocates one open local player-slot marker against the active Multiplayer.win session block at 0x006d1270. In probe mode `ecx=1` the helper checks that the local open-slot count and slot-marker bytes at `0x006cec7c+0x87` still fit within the remote slot counts and occupancy bytes rooted at `session+0x31b` and `session+0x3a3` and returns nonzero only when one additional slot can be claimed. In allocate mode `ecx=0` it finds the first locally empty slot whose remote occupancy byte is nonzero writes marker `0x64+index` into the local slot array increments `0x006cec7c+0x7b` and returns `0xff` on success.	ghidra + rizin + llvm-objdump
105	0x004ed590	224	multiplayer_sync_staged_text_controls	shell	cdecl	inferred	ghidra-headless	3	Synchronizes the shared Multiplayer.win staged-text buffer into the two mirrored text controls at ids 0xe48 and 0xe5d and then copies the same string back into the active selection buffer at 0x006cec74+0x1ef when it changed. The helper reallocates each control-owned backing string as needed and is used from the larger window initializer pending-status service and one delayed service-loop recovery branch.	ghidra + rizin + llvm-objdump
106	0x004ed800	109	multiplayer_preview_dataset_construct	shell	thiscall	inferred	objdump + caller xrefs	3	Constructor-style zero initializer for the large Multiplayer preview-dataset object later stored at `0x006cd8d8`. It clears the leading linkage and mode fields, resets the request and staging words around `0x8f18..0x8f44`, zeroes the shell-mode snapshot slots at `0x9050` and `0x9054`, clears the dataset state word at `0x985c`, seeds `0x9860` to `-1`, and leaves the object ready for the follow-on reset and dispatch paths.	objdump + caller xrefs
107	0x004ed890	164	multiplayer_schedule_requested_action	shell	cdecl	inferred	ghidra-headless	3	Initializes one requested Multiplayer.win action and resets the shared action globals before later dispatch. The helper writes the requested action id from EDI into 0x006d127c marks the action-active bit at 0x006d1274 clears the pending-step and substate fields at 0x006d1278 0x006d1280 and 0x006d1288 tears down the prior helper object at 0x006d1294 and allocates a fresh 0x10-byte helper. The currently named action writers above it queue action ids 1 and 4 from preview-dataset reset 2 from staged text-entry dialog setup 3 from staged text-entry commit and 5 or 6 from selected-preview follow-up branches.	ghidra + rizin + llvm-objdump
108	0x004ed940	235	multiplayer_rebuild_open_player_slot_markers	shell	cdecl	inferred	ghidra-headless	3	Rebuilds the local Multiplayer.win open-player slot markers from the active session slot table and republishes the resulting count. The helper clears any existing local slot bytes above `0x64` from `0x006cec7c+0x87` while decrementing `0x006cec7c+0x7b` then walks the remote slot records at `session+0x31b` with count `session+0x3ae`. For each remotely open record it uses multiplayer_probe_or_allocate_open_player_slot to claim the next local marker when capacity remains and then formats the updated open-slot count into shell control `0x6f` with resource id `0xe36`.	ghidra + rizin + llvm-objdump
109	0x004edc40	145	multiplayer_reset_preview_dataset_and_request_action	shell	cdecl	inferred	ghidra-headless	3	Resets the active Multiplayer.win preview dataset object at 0x006cd8d8 and immediately schedules the next requested action. The helper destroys any existing 0x9898-byte dataset object allocates and constructs a fresh one through 0x004ed800 clears the text control at id 0xe47 and the staged entry buffer at 0x006d11a8 and then queues action id 1 when the caller passes zero or action id 4 when the caller passes a nonzero dataset-related value.	ghidra + rizin + llvm-objdump
110	0x004ee0e0	225	multiplayer_open_staged_text_entry_dialog	shell	cdecl	inferred	ghidra-headless	3	Opens the small Multiplayer.win staged text-entry dialog and queues requested action 2. The helper chooses one of two prompt ids from the current preview mode copies the current profile text from 0x006cec74+0x1ef into the staging buffer at 0x006d1128 persists the profile state through 0x00484910 builds a formatted prompt string through 0x00518de0 and opens the modal shell dialog through 0x004c98a0 with the local callbacks at 0x004ed100 and 0x004ed4c0 before queuing action 2.	ghidra + rizin + llvm-objdump
111	0x004ee1d0	456	multiplayer_commit_staged_text_entry	shell	cdecl	inferred	ghidra-headless	3	Commits one staged Multiplayer.win text entry and queues requested action 3 when validation succeeds. The helper refreshes the mode-dependent prompt text saves the shared profile state through 0x00484910 copies either the caller-provided string or the text control 0xe47 into the staging buffer at 0x006d11a8 derives the companion buffer at 0x006d1228 from the current preview object or fallback globals and when the staged text exceeds five bytes schedules action 3 through multiplayer_schedule_requested_action; otherwise it clears the staged buffer and text control.	ghidra + rizin + llvm-objdump
112	0x004ee3a0	244	multiplayer_reset_tool_globals	shell	thiscall	inferred	ghidra-headless	3	Resets the smaller multiplayer-tool singleton state rooted around 0x006d1268 through 0x006d1270 for one shell mode created from 0x00482ec0. The helper seeds the shared vtable clears or rebinds the active singleton pointers and performs the same early shell-service notifications used by the larger Multiplayer.win initializer before later selection or preview code runs.	ghidra + rizin + llvm-objdump + strings
113	0x004ee430	141	multiplayer_update_preview_mode_labels	shell	cdecl	inferred	ghidra-headless	3	Updates the small mode-dependent label widget pair used by the Multiplayer.win preview branch. The helper chooses one of two label-id pairs anchored by string ids 0xe12 0xe18 and 0xe73 then writes them through 0x00540120 into shell controls such as ids 0x65 0x6d 0x86 and 0x87. It is called from multiplayer_load_selected_map_preview_surface the larger multiplayer initializer and the restore-from-globals callback.	ghidra + rizin + llvm-objdump + strings
114	0x004ee4c0	49	multiplayer_publish_control_0x69_mode	shell	cdecl	inferred	ghidra-headless	2	Publishes the current mode for Multiplayer.win control 0x69 from the presence of the session-related singleton at 0x006d40dc. The helper pushes mode 3 when that object exists or mode 1 otherwise through 0x00469d30 and is used after preview and count-setting branches to keep that control in sync with session state.	ghidra + rizin + llvm-objdump
115	0x004ee500	50	multiplayer_are_all_peer_ready	shell	cdecl	inferred	ghidra-headless	4	Returns true only when every element in the shell-owned multiplayer peer list exposed through 0x00521680 has ready flag bit 0x01 set at offset +0x5c. The service loop uses this gate before committing the larger multiplayer launch or transition branch.	ghidra + rizin + llvm-objdump
116	0x004ee540	352	multiplayer_refresh_peer_roster_list	shell	cdecl	inferred	ghidra-headless	3	Refreshes the Multiplayer.win peer-roster list for preview modes 0xe12 and 0xe13. The helper chooses one of two mode-dependent text ids updates control 0x8b when the current roster selection is valid enumerates either the direct peer list at 0x006d40d0 or the fallback dataset-backed names from 0x006cd8d8 into repeated control-0x88 entries and when no roster entries remain forces a preview-dataset reset through multiplayer_reset_preview_dataset_and_request_action. It also republishes one session-state byte into shell control 9 before returning.	ghidra + rizin + llvm-objdump
117	0x004ee6a0	359	multiplayer_refresh_map_entry_list	shell	cdecl	inferred	ghidra-headless	3	Refreshes the Multiplayer.win map-entry list for preview modes 0xe11 and 0xe13. The helper chooses one of two mode-dependent text ids writes the active selection header into control 0x8b walks up to 0x80 0x11c-byte records from the list object exposed by control 0xe47 publishes each entry into repeated control-0x88 rows and mirrors the currently selected matching row into control 0x66. The comparison path uses the current staged selection text copied into a local buffer before the list walk.	ghidra + rizin + llvm-objdump
118	0x004ee810	308	multiplayer_publish_wrapped_chat_message	shell	cdecl	inferred	ghidra-headless	4	Publishes one Multiplayer.win chat or status message into the mode-dependent chat pane. The helper chooses text resource `0xe32` or `0xe5c` from the current preview mode at `[window+0x7c]`; resolves the corresponding text list object through `0x0053f830`; word-wraps the supplied string to width `0x3e`; emits each wrapped row into control `0x88` through `0x00540120`; stores per-row metadata back into the list object; and finally updates the summary row in control `0x66` or clears the pane when the caller passes a null string. It is used by the local chat transport fallback; the named `%s > %s` message publisher; and the Multiplayer.win launch-side action wrappers.	ghidra + rizin + llvm-objdump + strings
119	0x004eed30	208	multiplayer_sync_selected_map_entry	shell	cdecl	inferred	ghidra-headless	3	Selection wrapper above 0x004ee950 for the multiplayer map-preview branch. It walks the current 0x25a-byte multiplayer entry table compares the selected record string against the shell selection buffer near 0x006cec7c and then calls 0x004ee950 with either the matching strings or null inputs to refresh the active preview state.	ghidra + rizin + llvm-objdump
120	0x004ee950	982	multiplayer_load_selected_map_preview_surface	shell	cdecl	inferred	ghidra-headless	4	Loads or refreshes the currently selected .gmt-backed preview surface for the multiplayer window family rooted at 0x006d1270. The routine validates the selected filename suffix copies selected strings into the active record updates preview or status values under offsets such as +0x3b2 and +0x3b6 formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer. The branch is anchored by the larger Multiplayer.win initializer at 0x004efe80.	ghidra + rizin + llvm-objdump + strings
121	0x004eee00	649	multiplayer_refresh_map_preview_panel	shell	cdecl	inferred	ghidra-headless	3	Refreshes the multiplayer map-preview panel for one requested preview state or sentinel value. The helper stores the requested state at [this+0x78] updates several shell text fields through 0x00540120 handles the special active state 0xe15 and the fallback -1 case copies the selected entry strings out of the multiplayer entry table at 0x006d126c into the shell selection buffer near 0x006cec7c and then routes through multiplayer_sync_selected_map_entry or multiplayer_load_selected_map_preview_surface before returning.	ghidra + rizin + llvm-objdump + strings
122	0x004ef090	365	multiplayer_select_preview_mode_and_refresh	shell	cdecl	inferred	ghidra-headless	3	Selects one of the top-level multiplayer preview modes identified by command ids 0xe10 through 0xe13 then refreshes the preview panel. The helper stores the requested mode at [this+0x7c] updates the four mode-button states through 0x00540120 handles the special 0xe12 branch with extra multiplayer refresh helpers and a direct multiplayer_refresh_map_preview_panel call for state 0xe15 emits a summary status field at 0xe55 falls back through multiplayer_refresh_map_preview_panel(-1) and finally refreshes the panel timestamp at [this+0x80] through 0x0051d890.	ghidra + rizin + llvm-objdump + strings
123	0x004ef200	1786	multiplayer_service_pending_status_state_machine	shell	cdecl	inferred	ghidra-headless	4	Services the pending Multiplayer.win status or transition state machine when the global flag at `0x006d1278` is set. The routine clears the pending flag switches over the queued step id at `0x006d1280` and now has several grounded branches: step `1` builds modal status `0xe4f` optionally appends owner text from `0x006d4118/0x006d411c` tears down the preview dataset at `0x006cd8d8` and refreshes control `0xcc`; step `2` clears `0x006cd920` destroys the preview dataset and opens status `0xe50`; step `3` gates on latch byte `0x006d1292` and warns with `0xe51`; step `4` requires `0x006cd920 != 0` and `0x006ae3c8 >= 3` or warns with `0xe52` otherwise it seeds a random `RT3Player%d` name into the staged-text controls through multiplayer_sync_staged_text_controls and sets `0x006ae3c4 = 2`; step `5` opens status `0xe54` then rebuilds the preview dataset through multiplayer_reset_preview_dataset_and_request_action. A second substate switch on `0x006d1284` formats statuses `0xe55..0xe5f` `0xe92` and `0xf53`; its `0x5` and `0x8` families either force preview mode `0xe13` or reseed the default player-name path before syncing the staged-text controls.	ghidra + rizin + llvm-objdump + strings
124	0x004ef960	1260	multiplayer_dispatch_requested_action	shell	cdecl	inferred	ghidra-headless	4	Dispatches the current requested Multiplayer.win action stored in `0x006d127c`. The switch drives six higher-level action cases that combine immediate mode changes through multiplayer_select_preview_mode_and_refresh with deferred pending-step writes into `0x006d1278` and `0x006d1280`. The grounded wrappers are now broader than before: action `1` either enters preview mode `0xe11` immediately or schedules pending step `1`; action `2` resets the local session-slot state through multiplayer_reset_local_session_slot_state copies the staged text buffers into the active dataset seeds one local open-slot marker refreshes the local player rows enters preview mode `0xe12` and rebuilds the open-slot markers; action `3` copies the staged text buffers back into the active multiplayer object and then uses the dataset mode at `[0x006cd8d8+0x0c]` to schedule pending steps `0xa` `0xb` `0xc` `0xe` or fallback `0x2` while its resolved-mode branch re-enters preview mode `0xe12` clears latches `0x006d1291/0x006d1292` and seeds the local player panel; action `4` promotes the committed staged text into preview mode `0xe13` or schedules pending step `5` or `6` from the launcher substate at `0x006d1288`; action `5` pumps the selected-map follow-up callback then either rebuilds the open-slot markers and refreshes status control `0x109` or schedules pending step `1` with control `0x11` updates depending on the current launch-side state; action `6` validates the staged text against the active dataset and schedules pending step `6` when the launcher substate remains armed.	ghidra + rizin + llvm-objdump
125	0x004efe80	1388	multiplayer_window_init_globals	shell	thiscall	inferred	ghidra-headless	4	Initializes the Multiplayer.win shell window family and its large backing state block. The constructor seeds the shared vtable at 0x005d12ac clears multiplayer globals under 0x006d1274 through 0x006d1288 allocates and zeroes a 0x100f2-byte data block stored at 0x006d1270 registers the active singleton at 0x006d1268 pushes the Multiplayer.win resource into the standard shell window setup helper and then continues with multiplayer-specific list and status initialization.	ghidra + rizin + llvm-objdump + strings
126	0x004f03f0	3612	multiplayer_window_service_loop	shell	cdecl	inferred	ghidra-headless	3	Top-level Multiplayer.win service loop. The function performs an early startup countdown through `0x006cd90c` calls multiplayer_service_pending_status_state_machine processes the special pending-step-10 gate with latch byte `0x006d1292` clears one text field when pending step 2 completes and then continues into the broader multiplayer update loop with timed retries staged-text synchronization peer-roster and map-entry list refresh helpers object-state checks and several mode-specific update branches. It queues requested action 5 after rebuilding one selected-map preview follow-up path and requested action 6 after the validated staged-text follow-up dialog branch. The launch-side inline wrappers now separate into three behaviors: a peers-not-ready warning dialog on resource `0xf15`; an add-open-slot path that seeds `0x006cec7c+0x83` stores the callback owner in `0x006d4110` and refreshes status control `0x109`; and a missing-session or slot-capacity warning path that opens modal dialogs on resources `0x2cf` `0x2b8` or `0x2b9`.	ghidra + rizin + llvm-objdump
127	0x004f13e0	167	multiplayer_restore_preview_state_from_globals	shell	thiscall	inferred	ghidra-headless	3	Restores the Multiplayer.win preview UI from the current global mode and preview-state fields. The callback refreshes the mode-dependent labels through multiplayer_update_preview_mode_labels mirrors selection presence into the active shell object toggles the 0x006d1291 recursion guard replays multiplayer_select_preview_mode_and_refresh and multiplayer_refresh_map_preview_panel using the saved fields at [this+0x7c] and [this+0x78] and if the active preview resources are missing schedules pending status step 7 by writing 0x006d1278 and 0x006d1280 instead of forcing an immediate redraw.	ghidra + rizin + llvm-objdump + strings
128	0x00502220	813	paint_terrain_load_selected_gmt_surface	shell	cdecl	inferred	ghidra-headless	4	Loads or refreshes the currently selected .gmt-backed preview surface for the PaintTerrain tool family rooted at 0x006d14bc and tied to the PaintTerrain.win or GroundTerrain.tga branch. The routine validates the selected filename suffix copies selected strings into the active record updates tool status bytes and counters formats several shell text fields through 0x00540120 and finishes by decoding a 256x256 image through 0x0053f830 and surface_init_rgba_pixel_buffer.	ghidra + rizin + llvm-objdump + strings
129	0x00502550	456	paint_terrain_refresh_status_panel	shell	cdecl	inferred	ghidra-headless	3	Refreshes the PaintTerrain tool status or selection panel after the active .gmt surface changes. The helper reads the PaintTerrain singleton at 0x006d14bc consults shell selection globals and lookup tables formats several text or numeric fields through 0x00540120 and toggles the side flag at 0x006d14a8 before returning.	ghidra + rizin + llvm-objdump + strings
130	0x00502720	144	paint_terrain_tool_init_globals	shell	thiscall	inferred	ghidra-headless	4	Initializes the PaintTerrain shell tool singleton rooted at 0x006d14bc. The constructor seeds the tool vtable and default fields registers the active instance globally and is selected directly from shell_transition_mode alongside the neighboring terrain-edit tool constructor at 0x004ee3a0.	ghidra + rizin + llvm-objdump + strings
131	0x00481d00	612	bootstrap_parse_command_line_flags	bootstrap	cdecl	inferred	ghidra-headless	4	Parses the startup command line from ECX handling slash and dash switches and writes multiple bootstrap globals and option buffers before shell service init.	ghidra + rizin
132	0x00481fd0	348	bootstrap_scan_autorun_media	bootstrap	cdecl	inferred	ghidra-headless	4	Scans drive letters for RT3 autorun marker files rt3d1.txt and rt3d2.txt using GetDriveTypeA and open or close helpers before deeper shell init.	ghidra + rizin
133	0x00482160	101	shell_state_service_active_mode_frame	shell	thiscall	inferred	objdump + analysis-context	4	Acts as the broader shell-state service pass around one active-mode update on the shell state rooted at 0x006cec74. The helper increments nested-service depth at [this+0x64] optionally notifies the active mode object at 0x006cec78 through 0x0051f940 and 0x00434050 primes the shell runtime at 0x006d401c through 0x00538b60 conditionally services the Multiplayer preview-dataset object at 0x006cd8d8 through 0x00469720 and then dispatches shell_service_frame_cycle on the global shell controller at 0x006d4024 before decrementing the depth counter.	objdump + analysis-context + caller xrefs
134	0x004821d0	1019	shell_recompute_layout_slots	bootstrap	thiscall	inferred	ghidra-headless	4	Recomputes the shell layout-slot table after resolution or related display selectors change; derives normalized coordinates from static float tables updates 144 slot entries through the shell bundle child at [0x006d4024+0x18] and then commits the refreshed state.	ghidra + rizin
135	0x00482ec0	1359	shell_transition_mode	bootstrap	thiscall	inferred	ghidra-headless	4	Switches the shell state's active mode at [this+0x08] tearing down any prior mode object selecting one of seven mode-specific handlers and updating globals like 0x006cec78 before notifying the shell bundle through 0x00538e50.	ghidra + rizin
136	0x005a2d64	101	crt_init_exit_handlers	startup	cdecl	inferred	ghidra-headless	3	Initializes on-exit tables and registers atexit handling before control reaches application startup.	ghidra + rizin
137	0x005a30f2	34	__amsg_exit	startup	cdecl	inferred	ghidra-headless	4	CRT fatal-exit helper that forwards startup failures into __exit.	ghidra + rizin
138	0x005a3117	36	crt_fast_error_exit	startup	cdecl	inferred	ghidra-headless	4	Startup error path that optionally emits the CRT banner then formats the failure and terminates through ___crtExitProcess.	ghidra + rizin
139	0x005a313b	423	crt_startup_entrypoint	startup	cdecl	inferred	ghidra-headless	4	PE entrypoint for patch 1.06; performs CRT and environment setup then validates early state before handing off to application bootstrap.	sha256:01b0d2496cddefd80e7e8678930e00b13eb8607dd4960096f527564f02af36d4 + ghidra + rizin + llvm-objdump
140	0x0053b020	70	bootstrap_reset_locale_state	bootstrap	unknown	inferred	ghidra-headless	2	Calls the locale helper at 0x0053ae70 then frees and clears related global pointers before later shell setup continues.	ghidra + rizin
141	0x0053b010	11	bootstrap_mark_runtime_started	bootstrap	cdecl	inferred	ghidra-headless	2	Single-purpose bootstrap helper that flips a process-global started flag to one before branding and shell setup continue.	ghidra + rizin
142	0x0054e6d0	42	bootstrap_capture_keyboard_state	bootstrap	cdecl	inferred	ghidra-headless	4	Single-purpose bootstrap probe that snapshots the host keyboard state through GetKeyboardState.	ghidra + rizin
143	0x0055da40	424	bootstrap_probe_system_profile	bootstrap	cdecl	inferred	ghidra-headless	4	Collects GlobalMemoryStatus and CPUID feature bits then stores coarse machine capability flags used by later bootstrap decisions.	ghidra + rizin
144	0x00507b90	346	station_place_refresh_category_controls	shell	cdecl	inferred	objdump + strings + RT3.lng	4	Refreshes the StationPlace.win category and mode controls for the current placement mode stored at 0x00622af4. The helper now grounds the six top-level category buttons rooted at 0x697c through 0x6981 as `Place a small station` 2197, `Place a medium station` 2198, `Place a large station` 2199, `Place a service tower` 2200, `Place a maintenance facility` 2201, and `Place a non-station building` 2202. It also refreshes the dependent controls around 0x69c8 0x69c9 0x6985 0x6986 and 0x6983 through 0x00540120; current evidence now bounds 0x6985 and 0x6986 as a two-state station-rotation policy toggle keyed by 0x006d1728, where 0x6985 aligns with `When placing the building, it will rotate itself as needed to orient to track or avoid obstacles.` string 2207 and 0x6986 aligns with `When placing the building, it will strictly adhere to the rotation specified by the circle above.` string 2206. In non-station-building mode 5 it can also seed [this+0x8c] from the active StationPlace list control under 0x006d1720 before preview formatting continues.	objdump + strings + RT3.lng + caller xrefs + callsite inspection
145	0x00508550	363	station_place_format_selected_site_summary	shell	cdecl	inferred	objdump + strings	3	Formats the selected StationPlace target summary for the live tool object. It looks up the active placement record index [this+0x8c] in 0x0062b2fc follows secondary data through field +0x173 into 0x0062b268 combines that with the current staged world coordinates at 0x006d1738 and 0x006d173c and emits the localized summary block through 0x00540120 into the StationPlace.win status area.	objdump + strings + caller xrefs + callsite inspection
146	0x00508730	292	station_place_format_preview_panel	shell	cdecl	inferred	objdump + strings	4	Formats the StationPlace.win preview panel for the currently selected placement record stored at [arg_4h+0x8c]. It chooses preview assets like 2DLabel.imb 2DCity.imb 2DVent.imb 2DMist.imb and 2DVolcano.imb for control 0x6982 and emits the matching text block through control 0x6984 using the geography tables rooted at 0x0062b2fc and 0x0062b268.	objdump + strings + caller xrefs + callsite inspection
147	0x00508880	727	station_place_select_category_and_refresh	shell	cdecl	inferred	objdump + strings + RT3.lng	4	Primary StationPlace.win category and selection refresh helper. It stores the requested placement mode at 0x00622af4, where current grounded evidence now maps 0..5 to small station, medium station, large station, service tower, maintenance facility, and non-station building. For the three station modes it also enables the secondary style strip rooted at 0x6988 0x6989 and 0x698c, where 0x6988 and 0x6989 cycle the current building style and 0x698c displays the active style token built from `StationSml` `StationMed` or `StationLrg` plus one of the six localized architecture styles `Victorian` 2672 `Tudor` 2671 `Southwest` 2670 `Persian` 2669 `Kyoto` 2668 and `Clapboard` 2667; the player-facing tooltip for that strip is `Scroll through building styles.` string 2203. The helper resolves the current selection through 0x00622af0 and 0x00622aec, repopulates the StationPlace list controls at 0x69df and 0x69e3, and then refreshes the preview and category panels through 0x00508730 and 0x00507b90.	objdump + strings + RT3.lng + caller xrefs + callsite inspection
148	0x00508bb0	510	station_place_world_surface_sync_and_dispatch	shell	thiscall	inferred	objdump + caller xrefs + strings	4	Shared world-surface helper for the active StationPlace.win tool object. It accepts direct `0x07d6` control traffic from the window dispatcher or falls back to the same shell detail-panel surface looked up through 0x006d0818, rechecks flag bit 0x4 on that control, performs world hit tests through 0x00448ac0, stages world coordinates into 0x006d1738 and 0x006d173c, refreshes the selected-site summary through 0x00508550, and updates the live placement selection globals at 0x00622af0 0x00622aec and 0x006d1740 plus helper objects rooted at [this+0x80] [this+0x84] and [this+0x88]. This makes it the clearest StationPlace-side consumer of the shared main-world interaction surface rather than only a passive status refresh helper.	objdump + caller xrefs + strings + callsite inspection
149	0x005091b0	967	station_place_window_handle_message	shell	thiscall	inferred	objdump + strings + RT3.lng	4	Primary message dispatcher for the StationPlace.win tool object at 0x006d1720. It switches over the incoming shell message id then handles the StationPlace control family rooted at category ids 0x697c through 0x6981, now grounded as the player-facing small station, medium station, large station, service tower, maintenance facility, and non-station-building buttons from strings 2197 through 2202. It also handles the style-strip controls at 0x6988 and 0x6989, which cycle the current building-style override used by station categories, the dependent controls around 0x6985 and 0x6986, now bounded as the two station-rotation policy choices from strings 2207 and 2206, the dedicated station-rotation circle control 0x6987, the list controls 0x69df and 0x69e3, and the shared world-surface control 0x07d6. The handler routes category and selection changes through 0x00508880 and 0x00507b90, uses 0x00507d80 for the live station-rotation drag/update branch, and delegates the world-hit-test path through 0x00508bb0. That makes it the clearest grounded owner for StationPlace player-facing tool commands rather than only a constructor plus frame hook.	objdump + strings + RT3.lng + caller xrefs + callsite inspection
150	0x00509d80	1936	station_place_window_construct	shell	thiscall	inferred	objdump + strings + RT3.lng	4	Constructs the StationPlace.win world-tool window object later published at 0x006d1720. The constructor seeds the vtable at 0x005d17c0 binds the StationPlace.imb helper asset and StationPlace.win resource through 0x0053d110 and 0x0053fa50 clears local selection and preview fields rooted at [this+0x7c] through [this+0x94], seeds the dedicated station-rotation circle control at 0x6987 through callback 0x00507a90, seeds the list controls 0x69df and 0x69e3, and stores the singleton plus helper handle globally at 0x006d1720 and 0x006d1724. Current evidence ties that 0x6987 branch to the player-facing `Click to rotate the building. You can also use bracket keys [ and ] to rotate buildings.` string 2208 rather than to the older `Building placement center` string 671; current recovered StationPlace code paths do not show a direct live lookup of string id 671 at all, which makes it look more like a stale or legacy label than a surviving control caption in the present window flow. The current grounded caller is the shell detail-panel constructor branch at 0x004dddc4.	objdump + strings + RT3.lng + caller xrefs + callsite inspection
151	0x0050a530	64	station_place_window_service_frame	shell	thiscall	inferred	objdump + caller xrefs	3	Recurring StationPlace.win service pass for the live station-placement tool object at 0x006d1720. The helper checks the local latch at [this+0x94] plus current shell or world selection state and then delegates one branch into 0x00508bb0 for follow-up station-placement synchronization on the same shared `0x07d6` main-world surface used by the dispatcher when the surrounding world tool remains active. Current grounded callers sit in the same recurring world and shell post-frame hooks used by sibling world-tool windows at 0x004423df 0x00444eda and 0x00445a64.	objdump + caller xrefs + callsite inspection
152	0x0050d2d0	1245	track_lay_window_refresh_controls	shell	thiscall	inferred	objdump + strings + RT3.lng	4	Refreshes the visible TrackLay.win control state after mode or preference changes. The helper highlights the three mutually exclusive primary mode buttons rooted at control ids 0x985e 0x985f and 0x9860 from the shared track-lay mode field at 0x00622b0c; current primary evidence now strongly aligns those grounded values as 1=`Lay single track.` string id 2054 4=`Lay double track.` string id 2055 and 0x40=`Bulldoze` string id 1721. The same refresh pass also updates the bridge-type selector family rooted at 0x006cec74+0x138 through controls 0x9861 and above; formats the two wrapped frequency values at 0x006cec74+0x140 and 0x006cec74+0x13c into controls 0x9870 and 0x9871 using the localized `Never` through `Common` string ids 615 through 618; and updates the two boolean preference toggles rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74 through controls 0x986e and 0x986d. Current evidence now strongly aligns that pairing as 0x986e or 0x006cec74+0x144 = `Auto-Hide Trees During Track Lay` strings 1838 and 1839 and 0x986d or 0x006cec78+0x4c74 = `Auto-Show Grade During Track Lay` strings 3904 and 3905: the first toggle lives in the compact track-lay preference block alongside bridge and frequency settings while the second lives in the broader display-runtime block and fits the grade-overlay behavior. The same refresh path also updates the electrify-all action control at 0x9873 and the surrounding status widgets, which makes it the clearest grounded owner for the TrackLay.win status panel rather than only a generic shell redraw.	objdump + strings + RT3.lng + callsite inspection
153	0x0050e1e0	534	track_lay_window_service_frame	shell	thiscall	inferred	objdump + caller xrefs + strings	4	Recurring TrackLay.win service pass for the active track-lay tool object at 0x006d1a8c. The helper decrements the local reentry guard at [this+0x87] and when the pass is active it either routes the current track-lay drag state through 0x0050d740 while the grounded `Bulldoze` mode value 0x40 is live in 0x00622b0c or synchronizes the staged world-interaction state back into the live world owner through 0x006cfca8 and 0x0050dce0. The same service family also special-cases control id 0x07d6 through the tool-owned current-control field [this+0x7e], which now strongly suggests that 0x07d6 is the shared main-world interaction surface for TrackLay.win rather than a generic shell-detail button. Current grounded callers sit in the recurring world and shell post-frame hooks at 0x004423ee 0x00444ee9 and 0x00445a73.	objdump + caller xrefs + strings + callsite inspection
154	0x0050e400	448	track_lay_window_construct	shell	thiscall	inferred	objdump + caller xrefs + strings	4	Constructs the TrackLay.win world-tool window object later published at 0x006d1a8c. The constructor seeds the vtable at 0x005d191c clears the tool-state fields rooted at [this+0x78] [this+0x7d] [this+0x82] and [this+0x87] binds the TrackLay.win resource through 0x0053fa50 refreshes the visible control set through 0x0050dc00 snapshots one world span from 0x0062c120 into 0x006d1a94 and stores the singleton globally before returning. The current grounded caller is the shell detail-panel constructor branch at 0x004ddecd.	objdump + caller xrefs + strings + callsite inspection
155	0x0050e5c0	3867	track_lay_window_handle_message	shell	thiscall	inferred	objdump + strings + RT3.lng	4	Primary message dispatcher for the TrackLay.win tool object at 0x006d1a8c. It switches over the incoming shell message id then handles control ids in the TrackLay.win family such as 0x9858 through 0x9874 plus the special world-surface control 0x07d6. The handler uses world hit tests through 0x00448ac0 to arm and release the drag latch at [this+0x7d] on 0x07d6 transitions, routes the active mode through the shared track-lay state at 0x00622b0c including the now-bounded primary values 1=`Lay single track.` 4=`Lay double track.` and 0x40=`Bulldoze`, updates the selected world object path rooted at 0x006cfca8+0x118, and refreshes the tool UI through 0x0050d2d0 0x0050d740 and 0x0050dce0. The same dispatcher also owns the TrackLay.win preference and action controls: it toggles the two boolean track-lay options rooted at 0x006cec74+0x144 and 0x006cec78+0x4c74, where current evidence now strongly aligns the first control branch at 0x985a with `Auto-Hide Trees During Track Lay` and the later `0x006cec78+0x4c74` branch with `Auto-Show Grade During Track Lay`; it also cycles the bridge-type selector family at 0x006cec74+0x138, wraps the two frequency settings at 0x006cec74+0x140 and 0x006cec74+0x13c, and routes the electrify-all command through the localized confirmation and failure strings 3083 3084 3837 and 3900. This makes it the clearest grounded owner for player-facing TrackLay.win commands rather than only a passive status panel.	objdump + strings + RT3.lng + callsite inspection
156	0x0051d900	155	string_find_substring_ex	support	cdecl	inferred	ghidra-headless	3	Reusable substring finder that returns a pointer to the first matching window in the haystack or null. It precomputes both string lengths then slides across the haystack calling one of two compare helpers depending on the mode flag pushed on the stack; the graphics branch uses it to probe adapter strings for legacy GPU-profile tokens and bootstrap code uses it for startup media or compatibility string checks.	ghidra + rizin + llvm-objdump
157	0x0051d870	21	bootstrap_seed_tick_count	bootstrap	cdecl	inferred	ghidra-headless	4	Lazily snapshots GetTickCount into a bootstrap-global cache so later subsystems start from a nonzero host tick baseline.	ghidra + rizin
158	0x0051ebc0	731	shell_reset_display_runtime_defaults	shell	cdecl	inferred	ghidra-headless	3	Resets the global display runtime defaults rooted at 0x006d4024. It clears the large display-settings block under offsets 0x11468a and above seeds default resolution and capability flags from mode 0x006d4028 and reinitializes several shell display toggles before later preset application continues.	ghidra + rizin + llvm-objdump
159	0x0051eea0	128	shell_save_display_runtime_config	shell	cdecl	inferred	ghidra-headless	4	Writes the larger display-runtime blob to data\\configuration\\engine.cfg. It stores version key 0x41b serializes the 0x1e4-byte runtime block rooted at [this+0x11468a] and writes an additional 0x1ec-byte companion block before closing the file.	ghidra + rizin + llvm-objdump + strings
160	0x0051ef20	194	shell_load_display_runtime_config_or_init_defaults	shell	cdecl	inferred	ghidra-headless	4	Loads the larger display-runtime blob from data\\configuration\\engine.cfg. When the file is missing invalid or already superseded by mode state at 0x006d4028 it falls back to 0x0051ebc0 and 0x0051eea0; otherwise it validates key 0x41b restores the 0x1e4-byte and 0x1ec-byte blocks and clears one shell display flag when [this+0x11474a] is set.	ghidra + rizin + llvm-objdump + strings
161	0x0051f0f0	3	shell_controller_get_window_handle	shell	thiscall	inferred	objdump + import-table	4	Returns the native shell window handle stored at [this+0x00]. Callers forward the returned handle into USER32 imports such as SetFocus SetMenu and SetCapture during shell startup and presentation interaction.	objdump + USER32 import table + callsite xrefs
162	0x0051f1d0	90	shell_signal_deferred_work_item_shutdown	shell	thiscall	inferred	ghidra-headless	3	Walks the shell deferred-work item queue at [this+0x1136a5] and inspects each queued payload object's nested message queue at [item+0xe4]. When intrusive_queue_peek_tail_payload finds a nonnull tail payload it clears the outer queued-handle slot at [item+0xe8] and appends a null sentinel into the nested queue through intrusive_queue_push_back before continuing iteration.	ghidra + rizin + llvm-objdump
163	0x0051f230	128	shell_enqueue_deferred_work_message	shell	thiscall	inferred	ghidra-headless	4	Routes one deferred-work message through the shell queue system. When the global routing gate at 0x006d4034 and shell flag [this+0x11369c] are both set it feeds the special queue at [this+0x11369d]; otherwise a nonnull payload object is queued once in [this+0x1136a5] with the returned queue-node handle cached at [item+0xe8] and the message is appended to the payload-owned nested queue at [item+0xe4] while a null payload appends directly into the fallback queue at [this+0x1136a1].	ghidra + rizin + llvm-objdump
164	0x0051f2b0	104	shell_post_deferred_message_type5	shell	thiscall	inferred	ghidra-headless	4	Allocates one 0x5e-byte deferred-message record from the shell-owned slab rooted at [this+0x5c] using count [this+0x58] tags it as type 0x05 stores four caller dwords at offsets +0x01 +0x05 +0x09 and +0x0d and then posts the record directly into the shell deferred queue roots through [this+0x11369d] or [this+0x1136a1].	ghidra + rizin + llvm-objdump
165	0x0051f320	72	shell_post_deferred_message_type6	shell	thiscall	inferred	ghidra-headless	4	Allocates one 0x5e-byte deferred-message record from the same shell slab and tags it as type 0x06 before posting it directly into the shell deferred queue roots. This is the minimal direct-post sibling of the type-0x05 builder and uses the same count field at [this+0x58] and slab base at [this+0x5c].	ghidra + rizin + llvm-objdump
166	0x0051f370	229	shell_enqueue_deferred_message_type4	shell	thiscall	inferred	ghidra-headless	4	Allocates one 0x5e-byte deferred-message record from the shell-local slab at [this+0x5c] populates the larger multi-field payload tags it as type 0x04 mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.	ghidra + rizin + llvm-objdump
167	0x0051f460	173	shell_enqueue_deferred_message_type1	shell	thiscall	inferred	ghidra-headless	4	Allocates one 0x5e-byte deferred-message record from the same shell-local slab fills the smaller type-0x01 payload subset mixes the shell byte [this+0x114227] into record byte +0x5d and routes the finished record through shell_enqueue_deferred_work_message.	ghidra + rizin + llvm-objdump
168	0x0051f510	48	shell_set_gamma_ramp_scalar	shell	thiscall	inferred	ghidra-headless	4	Applies one shell gamma-ramp scalar to the active display runtime state. When the presentation service pointer at [this+0x0c] is live it forwards the scalar into 0x00547f20 for an immediate hardware upload; otherwise it only caches the requested value at [this+0x1146b9] until the service is ready.	ghidra + rizin + llvm-objdump
169	0x0051fd70	516	shell_update_frame_time_history	shell	thiscall	inferred	ghidra-headless	4	Updates a 256-sample frame-time history from successive GetTickCount deltas. The helper advances the ring index in 0x006d403c stores each delta under [this+0x11428a] and derives a smoothed frame scalar at [this+0x114282] for later shell frame consumers such as 0x0051ff80 and the presentation-frame path.	ghidra + rizin + llvm-objdump
170	0x0051ff80	7	shell_get_smoothed_frame_scalar	shell	thiscall	inferred	objdump	4	Returns the smoothed frame scalar cached at [this+0x114282]. shell_update_frame_time_history refreshes that field each frame and shell_refresh_presentation_frame consumes it during the main presentation refresh path.	objdump + callsite xrefs
171	0x0051ff90	24	shell_install_global_controller	shell	thiscall	inferred	objdump + analysis-context	4	Installs one shell controller as the process-global singleton at 0x006d4024 clears controller flag [this+0x114201] reruns the local state reset helper at 0x0051ea80 and returns the same controller pointer. bootstrap_init_shell_window_services calls it immediately after allocating the 0x11486e-byte controller object.	objdump + analysis-context + startup xrefs
172	0x00521d10	38	multiplayer_request_peer_session_control	shell	cdecl	inferred	ghidra-headless	3	Requests one direct session-control action for a resolved multiplayer peer object. When the live session transport at `0x006d40dc` is present it follows the transport-owned interface at `[ecx+0x18e]->+0x08` and invokes vtable slot `+0x68` with the target peer object and three zero trailing arguments; the current grounded callers are the `\\kick` branch and the online-peer `\\unban` follow-up path.	ghidra + rizin + llvm-objdump
173	0x0051fa00	56	shell_get_memory_budget_ceiling_bytes	shell	thiscall	inferred	ghidra-headless	3	Returns the current upper memory-budget bucket in bytes for the shell display runtime. When override field [this+0x1146ca] is set it maps that tier through the shared table at 0x00624c34 containing 0 1MB 2MB and 4MB entries; otherwise it starts from baseline field [this+0x1136ad] and adjusts it by the active lower-tier delta derived from [this+0x1146c6] and [this+0x1136a9] before clamping negative results to zero.	ghidra + rizin + llvm-objdump
174	0x0051fa40	25	shell_get_memory_budget_floor_bytes	shell	thiscall	inferred	ghidra-headless	3	Returns the current lower memory-budget bucket in bytes for the shell display runtime. When field [this+0x1146c6] is nonzero it maps that tier through the shared 0 1MB 2MB 4MB table at 0x00624c34; otherwise it falls back to baseline field [this+0x1136a9].	ghidra + rizin + llvm-objdump
175	0x0051fa60	63	shell_get_nonnegative_memory_budget_floor_bytes	shell	thiscall	inferred	ghidra-headless	3	Returns a nonnegative lower memory-budget value for float consumers in the shell and presentation paths. It prefers explicit tier field [this+0x1146ce] then the active floor bucket behind [this+0x1146c6] and finally baseline field [this+0x1136a9] using the shared 0 1MB 2MB 4MB table at 0x00624c34 and clamping negative results to zero.	ghidra + rizin + llvm-objdump
176	0x005204b0	128	shell_flush_deferred_work_queues	shell	thiscall	inferred	ghidra-headless	4	Flushes the shell controller's three deferred-work queue roots at [this+0x1136a1] [this+0x11369d] and [this+0x1136a5]. The helper clears the first two containers through intrusive_queue_clear_and_release then rewinds the deferred-item queue through intrusive_queue_rewind_iterator repeatedly pops each queued payload through intrusive_queue_next_iterator_node clears its outer queued-handle slot at [item+0xe8] and finally releases the remaining queue storage before returning. It is used at the end of shell_service_frame_cycle and from the broader shell-mode helper at 0x00443a50.	ghidra + rizin + llvm-objdump
177	0x00520620	141	shell_service_frame_cycle	shell	thiscall	inferred	ghidra-headless	4	Acts as the outer owner for one pending shell frame cycle on the active controller. When pending-frame state is armed through [this+0x56] and controller pointers [this+0x18] [this+0x1c] and [this+0x28] are live it runs shell_refresh_presentation_frame through 0x0052b990; otherwise it still updates frame timing through 0x0051fd70 runs the mouse-cursor frame updater 0x0053f4e0 requests the deeper layout-state rebuild path through 0x00565110 performs a one-time ShowWindow on the controller window handle at [this] drains deferred work through 0x005204b0 and clears the pending flags at [this+0x56] and [this+0x58].	ghidra + rizin + llvm-objdump
178	0x00521060	805	bootstrap_init_shell_service_bundle	bootstrap	cdecl	inferred	ghidra-headless	4	Builds the shell-facing singleton bundle stored through globals like 0x006d4024 0x006d402c and 0x006d4030 wiring startup width and height state an rt3_ prefixed service path and the separate shell input-state object rooted at 0x006d4018.	ghidra + rizin + objdump
179	0x00521390	486	bootstrap_destroy_shell_service_bundle	bootstrap	cdecl	inferred	ghidra-headless	4	Destroys the shell service bundle created by 0x00521060 releasing each global singleton and clearing 0x006d4024 0x006d402c 0x006d4030 0x006d4020 and 0x006d4018.	ghidra + rizin
180	0x00523d90	65	shell_commit_layout_updates	bootstrap	thiscall	inferred	ghidra-headless	3	Applies pending layout-slot changes from the shell controller into its subordinate layout-state object at [this+0x2d] by walking embedded service pointers and issuing the follow-on rebuild or refresh calls that make the updated slot table live.	ghidra + rizin
181	0x00523e40	51	shell_invalidate_layout_state	bootstrap	thiscall	inferred	ghidra-headless	4	Marks the shell controller's layout-state path dirty by setting flags [this+0x3747] [this+0x3748] and [this+0x3749] then forwarding two state parameters into the subordinate object at [this+0x2d].	ghidra + rizin
182	0x005270d0	8	shell_mark_layout_dirty	bootstrap	thiscall	inferred	ghidra-headless	2	Marks the shell layout child dirty by setting byte flag [this+0x3749] before later code forces a commit pass.	ghidra + rizin
183	0x00527650	1476	shell_publish_texture_budget_report	shell	thiscall	inferred	ghidra-headless	4	Builds and publishes a shell-side texture budget report through the current layout state at [this+0x2d]. The routine formats the current memory-budget floor and ceiling buckets from 0x0051fa40 and 0x0051fa00 converts them to kilobytes adds the current texture-change counter through 0x0055d390 appends labels like Texture changes per frame Texture SRAM and Texture VRAM and forwards the assembled text into 0x00566980.	ghidra + rizin + llvm-objdump + strings
184	0x00527e10	868	shell_update_layout_tracking_sample	bootstrap	thiscall	inferred	ghidra-headless	4	Samples a tracked shell target from the object argument computes distance heading and orientation deltas against cached values at [this+0x36b8..0x36cc] consults the dirty flags and index helper at 0x00526590 and returns whether the controller should drive a fresh layout-state apply; on success it updates the cached sample fields and the global tick at 0x00cc3b4c.	ghidra + rizin
185	0x0052b990	4993	shell_refresh_presentation_frame	shell	thiscall	inferred	ghidra-headless	3	Main shell frame-style refresh pass for the active controller and layout-state path. It handles mode-sensitive layout-state rebuilds and dirties updates tracked shell samples through 0x00527e10 runs the nearby geographic-label static-cell animated-quad ranked-overlay and ranked-billboard sweeps applies presentation-node properties and cached vertex spans optionally publishes the texture budget report through 0x00527650 may request a deeper rebuild through 0x00565110 and can recurse once for a follow-up presentation pass before downstream timing or present helpers run.	ghidra + rizin + llvm-objdump
186	0x0052da00	102	vehicle_visual_register_attachment_object	bootstrap	thiscall	inferred	ghidra-headless	3	Registers one prebuilt attachment object on the owning vehicle visual. The helper lazily allocates a small attachment list at [this+0x81] pushes the object through 0x00556e10 copies the owner tint triple from [this+0x1e2] [this+0x1e6] and [this+0x1ea] into the object through 0x005545d0 and links the owner back through 0x005540a0.	ghidra + rizin + llvm-objdump
187	0x00529840	400	shell_build_static_cell_triangle_sweep	bootstrap	thiscall	inferred	ghidra-headless	4	Builds the fixed-cell triangle sweep over the grid returned by 0x00533cd0. It samples shell brightness to derive one grayscale packed color binds the layout-state vertex24 table once and then expands each accepted 0x24-byte cell record into six vertex24 records by emitting the same three-point face twice before committing the span and restoring presentation state.	ghidra + rizin + llvm-objdump
188	0x00529b50	1149	shell_build_geographic_label_vertex24_sweep	bootstrap	thiscall	inferred	ghidra-headless	4	Builds the geographic-label vertex24 sweep over the grid returned by 0x00533db0. It gates on config byte [this+0x29+0x63] primes one vertex24 span and text presentation state samples shell brightness and the 0x006d9098 priority map to derive per-item alpha rejects items through virtual check +0x0c emits per-item geographic-label frame geometry through 0x00539fb0 optionally emits geographic-label text through 0x0053a960 and commits buffered spans through the layout-state presentation helpers. The naming matches the dedicated geographic-label asset family backed by gpdLabelDB and 2DLabel.imb.	ghidra + rizin + llvm-objdump
189	0x00528d90	1824	shell_process_nearby_presentation_item	bootstrap	thiscall	inferred	ghidra-headless	3	Processes one candidate item for the nearby-presentation sweep. It rejects disabled entries and mode-mismatched flags optionally gates by forward-range tests around the caller origin lazily assigns the item's segment-record window from the layout-state tables stores accepted nearest-candidate distances in the side buffer at [this+0xa9] and [this+0xad] and forwards the item plus eligible child collections into the active presentation lists.	ghidra + rizin + llvm-objdump
190	0x005294b0	912	shell_update_nearby_presentation_sweep	bootstrap	thiscall	inferred	ghidra-headless	3	Performs the higher-level nearby-presentation sweep for the current shell state. It scans candidate cells from the offset table at [this+0x374f] using the priority map at 0x006d9098 enumerates item lists for each accepted cell normalizes the first accepted direction vector binds the segment-record presentation table through 0x0054bab0 calls 0x00528d90 for each candidate and then selects the nearest buffered item into [this+0x366e] before refreshing presentation batches through 0x00548da0.	ghidra + rizin + llvm-objdump
191	0x00529fd0	793	shell_build_cell_vertex24_sweep	bootstrap	thiscall	inferred	ghidra-headless	4	Builds the animated-quad cell sweep over the grid returned by 0x00533e30 depending on the boolean mode argument. It gates on configuration bytes [this+0x29+0x5f] or [this+0x29+0x60] walks candidate-cell offsets from [this+0x374f] selects the primary list at [cell+0x1c] or alternate list at [cell+0x20] initializes the layout-state vertex24 table once through 0x0054bb70 streams each list through 0x00567c70 or 0x00567ce0 and then commits the accumulated span through 0x00545c50 before restoring presentation state.	ghidra + rizin + llvm-objdump
192	0x0052a2f0	736	shell_build_ranked_overlay_vertex24_sweep	bootstrap	thiscall	inferred	ghidra-headless	3	Builds a ranked secondary vertex24 overlay pass over the cell grid returned by 0x00533e50 and two object collections at [this+0x85] and [this+0x81]. It computes a per-frame packed tint from the current shell brightness gathers and sorts candidate items by priority field [item+0x1d9] binds the layout-state vertex24 table and emits accepted items through 0x00524780 and 0x00554e70 before committing the span.	ghidra + rizin + llvm-objdump
193	0x0052a5d0	1784	shell_build_ranked_object_billboard_sweep	bootstrap	thiscall	inferred	ghidra-headless	3	Builds the sibling ranked object-overlay pass gated by config byte [this+0x29+0x5e]. It merges candidates from the object collections at [this+0x85] and [this+0x81] sorts them by priority field [item+0x1d9] prepares billboard basis state through 0x00566670 and emits accepted entries through 0x00554e70 before committing the vertex24 span.	ghidra + rizin + llvm-objdump
194	0x0052dd00	864	shell_expand_segment_record_triplets	bootstrap	thiscall	inferred	ghidra-headless	4	Expands one active presentation-batch record into three transformed 0x20-byte segment records inside the caller-provided buffer; each output record is two vec3 blocks at +0x00 and +0x0c plus scalar slots at +0x18 and +0x1c. The selected batch record supplies a source-array pointer at +0x04 a source-count at +0x0c and 0x4c-byte packed source entries that carry four point sources plus three scalar pairs for the emitted triplet.	ghidra + rizin
195	0x0053f4e0	739	mouse_cursor_update_frame_state	shell	thiscall	inferred	ghidra-headless	4	Per-frame MouseCursor.cpp updater for the global cursor controller at 0x00ccbb20. It refreshes elapsed tick state through 0x0051d890 re-arms the active cursor selection through 0x0053f450 and 0x0053f000 when the 150 ms and 15 s idle thresholds trip resets per-frame cursor globals through 0x0054f6c0 and 0x0054f6d0 samples cursor placement and world-relative state through world_anchor_measure_projected_half_width world_anchor_measure_projected_half_height and shell_queue_world_anchor_marker and publishes the resulting cursor presentation state through shell_publish_text_callout_presentation before finalizing through 0x0054f6e0.	ghidra + rizin + llvm-objdump + strings
196	0x0052e060	537	shell_expand_vertex24_triplets	bootstrap	thiscall	inferred	ghidra-headless	4	Sibling emitter for the same active presentation-batch record family; expands each 0x4c-byte packed source entry into three 0x18-byte vertex24 records in the caller-provided buffer. Each emitted record stores a vec3 at +0x00 a style dword from [this+0x43] at +0x0c and scalar slots at +0x10 and +0x14 while the output-count accumulator advances by count*3.	ghidra + rizin
197	0x0052eb20	51	shell_read_optional_presentation_extents4	bootstrap	thiscall	inferred	ghidra-headless	4	Reads an optional four-float extent block from the active presentation-batch record when byte flag [this+0x25] is set; copies dwords at +0x26 +0x2a +0x2e and +0x32 into caller outparams for the presentation-extents helper at 0x547d10.	ghidra + rizin
198	0x0052eca0	43	shell_get_next_presentation_batch_record	bootstrap	thiscall	inferred	ghidra-headless	4	Returns the next 0x45-byte presentation-batch record for the active item family rooted at [this+0x14] if current index [this+0x21] plus one is still below the family count at [+0x14]; otherwise returns null.	ghidra + rizin
199	0x00524780	1252	shell_emit_ranked_overlay_cell_items	bootstrap	thiscall	inferred	ghidra-headless	3	Processes one ranked-overlay cell list for 0x0052a2f0. It samples shell range thresholds through 0x00533180 and 0x00533160 filters cell items by distance and intensity derives an alpha-biased packed color from the caller input and emits accepted items into the current vertex24 span through layout helper 0x005468c0.	ghidra + rizin + llvm-objdump
200	0x00533ba0	39	shell_grid_get_nearby_presentation_cell	bootstrap	thiscall	inferred	ghidra-headless	4	Returns one tile-grid cell from the nearby-presentation layer rooted at [this+0x1671]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1671].	ghidra + rizin + llvm-objdump
201	0x00533cd0	39	shell_grid_get_static_vertex24_cell	bootstrap	thiscall	inferred	ghidra-headless	4	Returns one tile-grid cell from the fixed-geometry vertex24 layer rooted at [this+0x167d]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x167d].	ghidra + rizin + llvm-objdump
202	0x00533db0	30	shell_grid_get_geographic_label_cell	bootstrap	thiscall	inferred	ghidra-headless	4	Returns one tile-grid cell from the geographic-label layer rooted at [this+0x1675]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1675].	ghidra + rizin + llvm-objdump
203	0x00533e30	32	shell_grid_get_animated_quad_cell	bootstrap	thiscall	inferred	ghidra-headless	4	Returns one tile-grid cell from the animated-quad presentation layer rooted at [this+0x1681]. The helper converts world coordinates into 16x16 tile coordinates multiplies by the grid width stored at [this+0x15d9] and indexes the cell-pointer table at [this+0x1681].	ghidra + rizin + llvm-objdump
204	0x00533e50	32	shell_grid_get_ranked_overlay_cell	bootstrap	thiscall	inferred	ghidra-headless	4	Returns one tile-grid cell from the ranked secondary overlay layer rooted at [this+0x1685]. The helper uses the same 16x16 tile addressing and grid width field at [this+0x15d9] as the other shell cell-grid accessors and currently feeds 0x0052a2f0.	ghidra + rizin + llvm-objdump
205	0x00539fb0	924	shell_emit_geographic_label_frame_vertex24_records	bootstrap	thiscall	inferred	ghidra-headless	4	Expands the current geographic-label item into cached frame vertex24 records inside the caller buffer. The helper patches packed alpha into up to sixteen prebuilt 0x18-byte records copies additional 24-byte frame blocks from fixed item offsets and returns the emitted vertex count for the label border or backing geometry.	ghidra + rizin + llvm-objdump
206	0x0053a440	14	shell_set_geographic_label_item_alpha	bootstrap	thiscall	inferred	ghidra-headless	4	Stores an 8-bit alpha input into the high-byte color field at [this+0x5b] for the current geographic-label item before frame or text emission.	ghidra + rizin + llvm-objdump
207	0x0053a960	723	shell_emit_geographic_label_text_span	bootstrap	thiscall	inferred	ghidra-headless	4	Builds and emits one geographic-label text span for the current cell item. The helper calls the item vtable at +0x10 to materialize a null-terminated display string up to 0x12c bytes computes placement from item float fields and shell service state checks visibility through the shell bundle and forwards the resolved text payload into the presentation path through 0x005519f0. The item family aligns with gpdLabelDB and 2DLabel.imb rather than the parallel city assets.	ghidra + rizin + llvm-objdump
208	0x00543f10	853	layout_state_bind_presentation_asset_bundle	bootstrap	thiscall	inferred	ghidra-headless	4	Initial bind-time asset loader for the layout state's presentation node at [this+0x25df]; pulls a fixed presentation bundle through the node vtable at +0x5c and +0x60 including standalone assets stored around 0x2643 0x2647 0x264b 0x264f 0x2653 0x265b 0x265f and 0x2663 plus a 64-entry asset bank at 0x31ab while advancing an internal asset-offset cursor at [this+0x2543].	ghidra + rizin
209	0x00554830	142	attachment_object_init_named_asset	bootstrap	thiscall	inferred	ghidra-headless	3	Initializes one named attachment object from a caller-supplied asset string and placement parameters. The helper copies the asset name into the local object buffer at [this+0x10] stores attachment selectors at [this+0x130] and [this+0x138] optionally derives a cached scale pair at [this+0x120] and [this+0x124] and then finalizes object state through 0x005545d0.	ghidra + rizin + llvm-objdump
210	0x005455e0	224	layout_state_set_slot_triplet_lo	bootstrap	thiscall	inferred	ghidra-headless	4	Updates the first three cached per-slot presentation scalars in the 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 1 through 3.	ghidra + rizin + llvm-objdump
211	0x005456d0	240	layout_state_set_slot_triplet_hi	bootstrap	thiscall	inferred	ghidra-headless	4	Updates the second three cached per-slot presentation scalars in the same 24-byte slot table at [this+0x2597+slot*24]. In notify mode it compares against the cached values and forwards only changed fields into the bound presentation node through vtable slot +0xfc with subproperty ids 4 through 6.	ghidra + rizin + llvm-objdump
212	0x005458f0	169	layout_state_read_segment_record_window	bootstrap	thiscall	inferred	ghidra-headless	4	Gates the 32-byte segment-record table at [this+0x2643]; queries record bounds then copies a start-to-end or wrapped window into scratch storage at [this+0x2657] through vtable slot +0x2c while toggling byte flag [this+0x254e]. The downstream shell path treats each 0x20-byte record as two vec3 blocks plus two trailing scalars.	ghidra + rizin
213	0x005459a0	69	layout_state_read_segment_record_block	bootstrap	thiscall	inferred	ghidra-headless	4	Reads one 32-byte-indexed segment-record block from the same [this+0x2643] table into scratch storage at [this+0x2657] through vtable slot +0x2c using a fixed 0x2800-byte transfer span.	ghidra + rizin
214	0x00545b10	57	layout_state_read_vertex24_block	bootstrap	thiscall	inferred	ghidra-headless	4	Reads one 24-byte-indexed vertex block from the presentation table at [this+0x2647] through vtable slot +0x2c using index*24 addressing and returns the copied pointer through a stack outparam. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.	ghidra + rizin
215	0x00545b50	59	layout_state_read_vertex24_window	bootstrap	thiscall	inferred	ghidra-headless	4	Copies a window between two 24-byte vertex indices from [this+0x2647] into scratch storage at [this+0x2657] through vtable slot +0x2c using index*24 addressing and a fixed 0x1800-byte transfer span. The downstream shell emitter treats each record as vec3 plus a style dword plus two trailing scalars.	ghidra + rizin
216	0x00545c50	67	layout_state_commit_vertex24_span	bootstrap	thiscall	inferred	ghidra-headless	4	Converts a start and end vertex index range into a triplet count by dividing the delta by three accumulates that count at [this+0x3711] and notifies the bound presentation node at [this+0x25df] through vtable slot +0x118 with primitive-type argument 4.	ghidra + rizin
217	0x00546a30	333	layout_state_rebuild_variant_asset_cache	bootstrap	thiscall	inferred	ghidra-headless	3	Releases any loaded entries in the 64-slot presentation asset bank rooted at 0x31ab then rebuilds the paired-key metadata table at 0x266b tracking active entries count at [this+0x2667] and sibling or reuse links for later keyed lookups.	ghidra + rizin
218	0x005467a0	50	layout_state_enable_presentation_gate	bootstrap	thiscall	inferred	ghidra-headless	4	Ensures the presentation node gate property 0x1c is enabled once for the layout state when the template flag at [[this+0x83c]+0x2e] permits it by setting [this+0x2549] and forwarding the toggle into the node at [this+0x25df].	ghidra + rizin
219	0x00547d10	288	layout_state_apply_presentation_extents4	bootstrap	thiscall	inferred	ghidra-headless	4	Applies a four-float extent or quad block onto presentation property 0x18 for the bound node at [this+0x25df]. If all four inputs are nonpositive it clears the property through vtable slot +0xfc; otherwise it builds a 0x10-field stack block with the four caller values and a unit scalar then commits it through node slots +0xfc and +0x94.	ghidra + rizin + llvm-objdump
220	0x00547f20	177	layout_state_apply_gamma_ramp_scalar	bootstrap	thiscall	inferred	ghidra-headless	4	Builds a 256-entry three-channel gamma-ramp buffer from the caller scalar and uploads it through vtable slot +0x48 on the bound presentation node at [this+0x25df]. The helper clamps each 16-bit ramp entry stores the accepted scalar in the subordinate state block at [[this+0x83c]+0x2f] and respects shell capability guards under 0x006d4024 before touching the display device.	ghidra + rizin + llvm-objdump
221	0x00548da0	1328	layout_state_refresh_presentation_batches	bootstrap	thiscall	inferred	ghidra-headless	4	Walks the active presentation-batch list and refreshes the bound node state for each selected item. The routine applies batch extents through 0x00547d10 pushes style and gate properties including packed color property 0x3c updates per-slot triplets through 0x005455e0 and 0x005456d0 and emits segment-record or vertex24 spans from the current batch family before advancing to the next record.	ghidra + rizin + llvm-objdump
222	0x005492d0	3747	layout_state_probe_d3d8_capabilities	bootstrap	thiscall	inferred	ghidra-headless	4	Creates a Direct3D8 probe object and walks adapter or device capability queries for the layout-state presentation path. The routine caches probed texture-memory style fields into shell globals under 0x006d4024 including the values later reported as Texture SRAM and Texture VRAM consults the shell memory-budget helpers 0x0051fa40 and 0x0051fa60 refreshes the gamma ramp through 0x00547f20 when needed and assigns a local renderer capability tier at [this+0x04].	ghidra + rizin + llvm-objdump + strings
223	0x0054a280	626	layout_state_apply_presentation_properties	bootstrap	thiscall	inferred	ghidra-headless	4	Pushes visibility color and mode-dependent scalar properties from the layout state into the bound presentation node at [this+0x25df]; toggles gate property 0x1c writes packed color property 0x22 from bytes 0x2510..0x2512 updates mode properties 0x23 through 0x26 from template flags and caller-supplied scalars and caches the leading scalar at [this+0x25b3].	ghidra + rizin
224	0x0054bab0	89	layout_state_bind_segment_record_table	bootstrap	thiscall	inferred	ghidra-headless	4	Binds the current 32-byte segment-record table at [this+0x2643] onto the presentation node if it changed since the last bind. The helper drives node property 0x112 through vtable slots +0x130 and +0x14c with record size 0x20 and clears the local dirty byte at [this+0x263b].	ghidra + rizin + llvm-objdump
225	0x0054bb70	90	layout_state_bind_vertex24_table	bootstrap	thiscall	inferred	ghidra-headless	4	Binds the current 24-byte vertex24 table at [this+0x2647] onto the presentation node if it changed since the last bind. The helper drives node property 0x142 through vtable slots +0x130 and +0x14c with record size 0x18 and clears the local dirty byte at [this+0x263b].	ghidra + rizin + llvm-objdump
226	0x0054bc10	592	shell_init_layout_state_defaults	bootstrap	thiscall	inferred	ghidra-headless	4	Initializes the large subordinate layout-state object allocated by 0x0055e2b0; seeds default float and flag fields points [this+0x83c] at a shell-bundle template block near 0x006d4024+0x11468a optionally copies a 0x72c-byte preset table and notifies the shell bundle service at [0x006d4024+0x28].	ghidra + rizin
227	0x0054bea0	1399	layout_state_apply_interpolated_pose	bootstrap	thiscall	inferred	ghidra-headless	4	Applies an interpolated pose and palette sample on the subordinate layout-state object using the controller counters passed by callers; clamps the time window blends preset tables at offsets 0x840 through 0x86f updates color bytes at 0x2510 through 0x2512 invokes the bound presentation node at [this+0x25df] and finishes through 0x0054a280.	ghidra + rizin
228	0x0054e3a0	528	shell_controller_window_message_dispatch	shell	stdcall	inferred	objdump	4	Primary window-message ingress for the active shell controller window. The dispatcher branches over low window lifecycle messages handles `WM_KEYDOWN` and `WM_KEYUP` by first updating the shell controller through 0x0051f0c0 or 0x0051f0d0 and then forwarding the transition into shell_input_apply_window_key_transition at 0x0054f290 on the shell input object rooted at 0x006d4018 routes `WM_COMMAND` through 0x0054eb10 routes mouse messages in the `0x0200..0x0208` family through 0x0054ee50 and falls back to `DefWindowProcA` for unhandled cases. This is the first grounded shell-side input ingest path rather than only a generic message drain.	objdump + import table + callsite inspection
229	0x0054e5d0	88	shell_drain_pending_window_messages	shell	cdecl	inferred	objdump + analysis-context	4	Shared pending-message drain that loops on `PeekMessageA` with remove mode 1 and feeds each dequeued record through `TranslateMessage` and `DispatchMessageA` until the queue is empty. Shell modal waits layout rebuild paths mouse-cursor frame work and the keyboard-toggle helpers all reuse this routine so it sits below the real input handlers rather than serving as the input dispatcher itself.	objdump + analysis-context + import table
230	0x0054e710	110	shell_input_state_init	shell	thiscall	inferred	objdump + analysis-context	3	Initializes the standalone shell input-state object later stored at 0x006d4018. It zeroes the 0xaa8-byte state block resets counters and flags under +0xa88 through +0xa9c caches host metrics through `GetSystemMetrics` and `GetDoubleClickTime` and clears the per-key state storage that later window-message handlers update.	objdump + analysis-context + import table
231	0x0054f290	480	shell_input_apply_window_key_transition	shell	thiscall	inferred	objdump + analysis-context	4	Normalizes one `WM_KEYDOWN` or `WM_KEYUP` transition for the shell input object at 0x006d4018. The helper samples `GetKeyboardState` optionally derives an ASCII byte through `ToAscii` updates the 256-byte per-key table starting at [this+0x100] and maps selected keyboard scan codes into packed modifier flags at [this+0xa8c]: 0x1d sets or clears bit 0x4 Control 0x2a sets or clears bit 0x2 Left Shift 0x36 sets or clears bit 0x1 Right Shift and 0x38 sets or clears bit 0x20 Alt. It then forwards the synthesized event record through 0x0054e9c0 for later shell consumers. The shell controller window dispatcher at 0x0054e3a0 is the grounded caller.	objdump + analysis-context + import table + callsite inspection
232	0x0054f4d0	109	shell_input_snapshot_dispatch_state	shell	thiscall	inferred	objdump + analysis-context	3	Captures one filtered snapshot of the current shell input object state into a 0x30-byte caller buffer while temporarily zeroing the nested-dispatch counter at [this+0xa90]. Several shell and cursor consumers use this as the read-side companion to shell_input_apply_window_key_transition optionally passing the snapshot through the callback hook stored at 0x006d4008 before consuming it.	objdump + analysis-context + caller xrefs
233	0x0054f540	111	shell_input_cursor_inside_active_view	shell	cdecl	inferred	objdump + analysis-context	3	Returns whether the current cursor position should count as being inside the active shell controller view. When controller byte [0x006d4024+0x114226] is already set it returns true immediately; otherwise it samples the host cursor through `GetCursorPos` converts it into client coordinates for the active controller window through `ScreenToClient` and checks that point against the current view bounds selected from the shell controller table at [0x006d4024+0x34] and [0x006d4024+0x11421e]. Current grounded callers are the mouse-cursor mode helper at 0x0053f450 and the shell camera action helper at 0x004e0780 which suggests later world-relative cursor work still reuses the same shell controller path rather than a separate gameplay-only input object.	objdump + analysis-context + import table + caller xrefs
234	0x0054f640	83	shell_step_global_presentation_phase_scalar	shell	cdecl	inferred	ghidra-headless	2	Steps the shared presentation-phase scalar stored at 0x00d93850 downward by a small constant then clamps the returned value against fixed lower-bound constants. Callout-marker world-anchor and other presentation helpers use this as a common time-varying scalar after one of the nearby setters has seeded the global phase.	ghidra + rizin + llvm-objdump
235	0x0054f700	12	shell_set_global_presentation_phase_scalar	shell	cdecl	inferred	ghidra-headless	3	Stores one caller-supplied float into the shared presentation-phase scalar at 0x00d93850. Mouse-cursor geographic-label and other presentation helpers seed this global before later batch or marker helpers consume it through 0x0054f640.	ghidra + rizin + llvm-objdump
236	0x0054f710	729	shell_queue_callout_segment_marker	shell	cdecl	inferred	ghidra-headless	2	Queues one short world-space callout segment or marker packet using the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34]. The helper derives scaled endpoint deltas from the caller inputs applies flag-controlled clamps from arg_14h and emits three type-0x01 deferred messages through shell_enqueue_deferred_message_type1.	ghidra + rizin + llvm-objdump
237	0x0054f9f0	281	shell_queue_callout_frame_segments	shell	cdecl	inferred	ghidra-headless	4	Builds a four-segment callout frame around one projected extent box. The helper samples the same shell zoom and reciprocal scale tables under 0x006d4024 computes the four box legs from the caller extent inputs and emits each side through shell_queue_callout_segment_marker.	ghidra + rizin + llvm-objdump
238	0x0054fb10	699	shell_queue_callout_leader_path	shell	cdecl	inferred	ghidra-headless	3	Builds one longer world-space callout leader path between two points. It derives slope and angle terms from the caller inputs recursively reuses itself or 0x0054f710 for shorter segments chooses style branches from distance and flag tests and enqueues the resulting type-0x01 deferred messages. shell_publish_text_callout_presentation uses this helper for text-associated leader geometry.	ghidra + rizin + llvm-objdump
239	0x0054fdd0	256	shell_queue_presentation_batch_pair	shell	cdecl	inferred	ghidra-headless	2	Queues a two-record presentation batch through the shell deferred-message path. One branch emits a single trailing type-0x04 record while the other brackets two type-0x04 payload posts with direct type-0x05 and type-0x06 begin-end records; both legs seed their animated scalar through shell_step_global_presentation_phase_scalar before routing through the shell bundle at 0x006d4024.	ghidra + rizin + llvm-objdump
240	0x0054fed0	440	shell_queue_presentation_batch_quad	shell	cdecl	inferred	ghidra-headless	2	Queues a four-record presentation batch through the same deferred-message family. It posts a type-0x05 begin record emits four type-0x04 payload records with refreshed phase scalars from shell_step_global_presentation_phase_scalar and finally closes the batch with a type-0x06 end record. The current high-level callers build this from four related point or extent tuples.	ghidra + rizin + llvm-objdump
241	0x005519f0	902	shell_publish_text_callout_presentation	shell	cdecl	inferred	ghidra-headless	3	Publishes one styled text or callout presentation payload through the active shell bundle at 0x006d4024. It accepts text placement and style inputs conditionally emits a leader path through 0x0054fb10 allocates backing text resources through 0x0051f0b0 and 0x00543c10 sets presentation flags from the mode arguments and finalizes the payload through 0x0051fc20. Geographic-label text and mouse-cursor presentation both feed this helper.	ghidra + rizin + llvm-objdump + strings
242	0x00552160	56	world_anchor_measure_projected_half_width	shell	cdecl	inferred	ghidra-headless	3	Measures one absolute projected half-width-like extent from the caller world-anchor object. It chooses the X or Z span depending on orientation byte [this+0x24] scales by the owner coefficients at +0x2e or +0x32 multiplies by local width scalar [this+0x1c] and returns the absolute result for later cursor or marker placement code.	ghidra + rizin + llvm-objdump
243	0x005521a0	56	world_anchor_measure_projected_half_height	shell	cdecl	inferred	ghidra-headless	3	Measures one absolute projected half-height-like extent from the caller world-anchor object. It chooses the complementary axis span using the same orientation byte [this+0x24] scales by owner coefficients at +0x2e or +0x32 multiplies by local height scalar [this+0x20] and returns the absolute result for later cursor or marker placement code.	ghidra + rizin + llvm-objdump
244	0x005521e0	894	world_anchor_project_screen_extent_pair	shell	cdecl	inferred	ghidra-headless	3	Projects one world-anchor object into a paired screen-space extent result. The helper samples the shell zoom table under 0x006d4024 computes integer-scaled axis spans from the anchor geometry converts them through multiple clamp or reciprocal stages and writes two output integers through the caller pointers before later marker builders use the results for anchor presentation sizing.	ghidra + rizin + llvm-objdump
245	0x00552560	916	shell_queue_world_anchor_marker	shell	cdecl	inferred	ghidra-headless	3	Builds one world-anchor marker packet from the caller point object and optional scale or style inputs. It samples anchor extents from the object fields converts them through 0x0053dde0 0x0053ddf0 and world_anchor_project_screen_extent_pair consults the shell zoom table rooted at [0x006d4024+0x11421e] and [0x006d4024+0x34] and finally enqueues one type-0x01 deferred message through shell_enqueue_deferred_message_type1. mouse_cursor_update_frame_state uses it for one branch of cursor world-relative presentation.	ghidra + rizin + llvm-objdump
246	0x00552900	1304	shell_queue_projected_world_anchor_quad	shell	cdecl	inferred	ghidra-headless	3	Builds one oriented projected quad around the caller world-anchor object. It derives four projected corner points from the anchor extents and orientation computes edge and diagonal lengths through 0x0051db80 samples the shared presentation phase through shell_step_global_presentation_phase_scalar refines screen-space bounds through world_anchor_project_screen_extent_pair and finally emits two type-0x04 deferred-message posts through shell_enqueue_deferred_message_type4.	ghidra + rizin + llvm-objdump
247	0x00554d70	248	billboard_item_build_anchor_point_cache	bootstrap	thiscall	inferred	ghidra-headless	3	Builds or refreshes the cached point list for one billboard item at [this+0x1dd]. When source points exist at [this+0x10] it transforms them through the owner object matrix near [this+0x0c]+0xce; otherwise it seeds a one-point fallback from the baked vector at [this+0xfe..0x106].	ghidra + rizin + llvm-objdump
248	0x00554e70	680	shell_emit_ranked_sprite_billboard_item	bootstrap	thiscall	inferred	ghidra-headless	4	Emits one ranked sprite-billboard item into the current vertex24 span. The helper computes a distance-weighted fade against shell and world state stores the derived scalar at [item+0xdc] and then walks either the item's linked child list at [item+0x4] or the cached anchor list at [item+0x1dd] to write textured quad geometry through 0x005662a0.	ghidra + rizin + llvm-objdump
249	0x00555740	49	billboard_item_refresh_child_sprite_colors	bootstrap	thiscall	inferred	ghidra-headless	3	Refreshes packed child-sprite colors for one billboard item by iterating the linked child list at [this+0x4] recomputing each child color through 0x005554f0 and storing the 24-bit result at [child+0x70].	ghidra + rizin + llvm-objdump
250	0x00555780	1739	sprite_billboard_spawn_particle_instance	bootstrap	thiscall	inferred	ghidra-headless	4	Builds one emitted sprite-billboard instance from the template item. It randomizes local offsets through fields [this+0x7c..0x90] optionally samples anchor points from the owner matrix or cached path data chooses atlas uv bounds from [this+0x110..0x124] applies scale and fade terms from [this+0x94..0x108] recomputes packed colors through 0x005554f0 and finalizes the instance through 0x00565e80 and 0x00565f40.	ghidra + rizin + llvm-objdump
251	0x00555e50	1808	sprite_billboard_update_particle_emitter	bootstrap	thiscall	inferred	ghidra-headless	4	Advances one sprite-billboard emitter template and spawns new instances through 0x00555780. The routine updates emitter clocks and travel bounds in [this+0x68..0xc8] applies burst or repeat controls through [this+0x1ed..0x1f9] walks up to [this+0x34] spawn lanes resolves anchor positions from cached or owner-derived points and refreshes the active emitter origin at [this+0xc0] and [this+0xc4].	ghidra + rizin + llvm-objdump
252	0x0055d430	6	system_get_total_physical_memory_bytes	support	cdecl	inferred	ghidra-headless	4	Returns the cached total physical-memory byte count from the shared MEMORYSTATUS block at 0x00d9754c. The graphics preset bundle uses this value as one of its coarse runtime capability probes after the cache has been refreshed through GlobalMemoryStatus nearby.	ghidra + rizin + llvm-objdump
253	0x0055d440	17	system_refresh_available_physical_memory_bytes	support	cdecl	inferred	ghidra-headless	4	Refreshes the shared MEMORYSTATUS block at 0x00d97548 through GlobalMemoryStatus and returns the resulting available physical-memory byte count from dwAvailPhys. This is the active memory-availability probe companion to 0x0055d430.	ghidra + rizin + llvm-objdump + strings
254	0x0055d460	81	os_is_non_nt_platform	support	cdecl	inferred	ghidra-headless	4	Calls GetVersionExA and returns true only when the platform id is not VER_PLATFORM_WIN32_NT. The graphics preset bundle inverts this result into an NT-family capability flag before finalizing several display-runtime bytes under 0x006d4024.	ghidra + rizin + llvm-objdump + strings
255	0x0055d8d0	138	display_get_primary_adapter_descriptor	support	cdecl	inferred	ghidra-headless	4	Enumerates display devices through USER32.EnumDisplayDevicesA until it finds the primary adapter flag then copies the adapter DeviceString field into the global buffer at 0x00d97448 and returns that buffer. When enumeration fails it leaves the descriptor empty and still returns the same shared buffer pointer. The graphics preset matcher at 0x00484a60 consumes this descriptor text directly.	ghidra + rizin + llvm-objdump + strings
256	0x005a0f70	209	stream_cipher_xor_in_place	support	cdecl	inferred	rizin	4	Applies one stateful stream-cipher pass in place over the caller buffer in ECX for the caller byte count in EDX using the 0x102-byte cipher state block passed on the stack. The helper mutates the two state bytes at offsets `+0x100` and `+0x101` and uses the 0x100-byte permutation table at the start of the state block to XOR every byte in the buffer. Current grounded callers are the multiplayer transport text-stream receive and send paths.	rizin + llvm-objdump
257	0x005a18a0	292	string_copy_bounded_zerofill	support	cdecl	inferred	ghidra-headless	4	Shared bounded string-copy helper that copies up to count bytes from source to destination stops after the first NUL byte and zero-fills the remaining span before returning the destination pointer. The graphics preset matcher uses it to stage the primary adapter descriptor into a local probe buffer before substring token scans	ghidra + rizin + llvm-objdump
258	0x00556620	305	sprite_billboard_manager_reset	bootstrap	thiscall	inferred	ghidra-headless	3	Releases the shared sprite-billboard manager state including emitter slots at [this+0x10] queued templates at [this+0x18] and owned resource handles or containers before zeroing the manager pointers again.	ghidra + rizin + llvm-objdump
259	0x00556770	420	sprite_billboard_manager_init_pools	bootstrap	thiscall	inferred	ghidra-headless	4	Initializes the shared sprite-billboard manager when the shell first needs emitter templates. It allocates the long-lived emitter arrays and container objects at [this+0x10] [this+0x18] [this+0x8] [this+0x4] and [this+0x0] with a default capacity of 0xc350 slots unless the caller overrides it.	ghidra + rizin + llvm-objdump
260	0x00556920	814	sprite_billboard_init_emitter_template	bootstrap	thiscall	inferred	ghidra-headless	4	Initializes one sprite-billboard emitter template from optional source geometry color flags and atlas bounds. It copies source points or seeds a fallback anchor path stores owner position seeds default fade and timing fields across [this+0x94..0xd8] computes atlas uv steps from [this+0xe0..0xec] into [this+0x110..0x124] and optionally prewarms the spawn list through 0x00554ce0 when the caller flags request it.	ghidra + rizin + llvm-objdump
261	0x00556c50	143	sprite_billboard_manager_create_template_node	bootstrap	thiscall	inferred	ghidra-headless	4	Allocates or reuses one manager node then creates a fresh sprite-billboard template through 0x00556920 with flag 0x400 forced on. The helper stores the new template at [node+0x4] and queues the node into the manager container at [this+0x8].	ghidra + rizin + llvm-objdump
262	0x00556ce0	160	sprite_billboard_manager_clone_template_node	bootstrap	thiscall	inferred	ghidra-headless	4	Looks up one existing manager node and either returns its current template or clones a new sprite-billboard template from it through 0x00556920. On the first clone path it prewarms the source template through 0x00554ce0 and then queues the new node into the manager container at [this+0x4].	ghidra + rizin + llvm-objdump
263	0x00556e10	54	intrusive_queue_push_back	support	cdecl	inferred	ghidra-headless	4	Allocates one intrusive-queue node then appends the caller payload pointer to the tail of the container. The helper writes the payload at [node+0x00] links the previous tail through [node+0x04] and [tail+0x08] updates the head and tail slots when needed and increments the queued-node count at [this+0x0c].	ghidra + rizin + llvm-objdump
264	0x00556ef0	6	intrusive_queue_rewind_iterator	support	cdecl	inferred	ghidra-headless	4	Resets one intrusive-queue iterator by copying the container head pointer at [this+0x00] into the current-iterator slot at [this+0x04]. The helper is reused broadly across shell presentation and gameplay container walkers before repeated next-node calls.	ghidra + rizin + llvm-objdump
265	0x00556f00	19	intrusive_queue_next_iterator_node	support	cdecl	inferred	ghidra-headless	4	Returns the current intrusive-queue iterator node from [this+0x04] then advances the iterator to the linked next pointer at [node+0x08]. When the iterator is exhausted it returns null without mutating any payload state.	ghidra + rizin + llvm-objdump
266	0x00556f90	13	intrusive_queue_peek_tail_payload	support	cdecl	inferred	ghidra-headless	4	Returns the payload pointer stored in the current tail node at [this+0x08]. When the container is empty it returns null without mutating the queue state.	ghidra + rizin + llvm-objdump
267	0x00557010	159	intrusive_queue_clear_owned_nodes	support	cdecl	inferred	ghidra-headless	3	Specialized intrusive-queue clear path for containers with an auxiliary owner or context pointer at [this+0x14]. It iterates the owned node chain through the queue iterator helpers releases nested payload state unlinks each node and decrements the queue count before returning to the outer container clear helper.	ghidra + rizin + llvm-objdump
268	0x005570b0	80	intrusive_queue_clear_and_release	support	cdecl	inferred	ghidra-headless	4	Clears and releases every node in one intrusive queue container. When [this+0x14] is present it routes through intrusive_queue_clear_owned_nodes; otherwise it walks the linked nodes directly releases them zeroes the head iterator and tail slots and resets the queued-node count at [this+0x0c].	ghidra + rizin + llvm-objdump
269	0x00559520	166	surface_init_rgba_pixel_buffer	support	thiscall	inferred	ghidra-headless	3	Initializes or refreshes a small 0xec-byte RGBA pixel-buffer object from caller-supplied image data and dimensions. On first use it allocates the backing object through 0x0053b070 stores width and height at [this+0xa2] and [this+0xa6] seeds the inner surface through 0x00543980 and 0x00541970 then copies width*height*4 bytes from the source buffer before finalizing through 0x005438d0. Current callers use it from the PaintTerrain preview path and the Multiplayer.win map-preview branch.	ghidra + rizin + llvm-objdump + strings
270	0x00565110	600	shell_rebuild_layout_state_and_optional_texture_report	shell	thiscall	inferred	ghidra-headless	3	Rebuilds the active shell layout-state branch when the current mode requires a deeper reset and optionally publishes the texture budget report through 0x00527650. The routine checks the current layout mode through 0x00545e00 tears down and recreates layout-state services through 0x0055dd80 and 0x0055e2b0 optionally notifies global shell services and when the caller flag is set emits the report then commits one layout refresh step through 0x00545d60.	ghidra + rizin + llvm-objdump + strings
271	0x0058d7a0	55	multiplayer_transport_set_local_name	shell	thiscall	inferred	ghidra-headless	3	Updates the local identity string stored in the session-event transport object. When the transport is already configured through [this+0x44] and the incoming name pointer is non-null and non-empty it copies up to 0x40 bytes into [this+0x04] clears byte [this+0x43] and then forwards the same name into the lower transport update path through 0x0058f330.	ghidra + rizin + llvm-objdump
272	0x0058d830	40	multiplayer_transport_disconnect	shell	thiscall	inferred	ghidra-headless	3	Disconnects the session-event transport object from its current live route. The helper flips the internal active state through 0x005965d0 and 0x005961b0 calls the shared teardown block at 0x0058d810 and finally clears byte [this+0x60] and the copied local name at [this+0xaf4].	ghidra + rizin + llvm-objdump
273	0x0058d860	59	multiplayer_transport_release_worker_and_reset_runtime_state	shell	cdecl	inferred	rizin	3	Small runtime-reset wrapper for the outer session-event transport object. When the owned worker pointer at [this] is present it first tears that worker down through multiplayer_transport_worker_shutdown_gracefully then clears the worker pointer the configured flag byte at [this+0x04] the text-stream owner slots at [this+0x44] and [this+0x48] reruns 0x00593370 and the shared reset block at 0x0058d810 and finally clears the live route and deferred-runtime fields at [this+0x180c] [this+0x1810] and [this+0x1edc].	rizin + llvm-objdump
274	0x0058d960	7	multiplayer_transport_select_status_route	shell	thiscall	inferred	ghidra-headless	3	Thin route-selector wrapper for the session-event transport. It forwards the requested small route id in EDX into multiplayer_transport_set_mode_q_flag which updates [this+0x560] formats the underlying `MODE %s -q` or `MODE %s +q` command text and reconfigures the transport-side callback plumbing.	ghidra + rizin + llvm-objdump
275	0x0058d970	89	multiplayer_transport_subscribe_field_callback_set	shell	thiscall	inferred	ghidra-headless	3	Registers one field-subscription callback set on the session-event transport. When the transport is active byte [this+0x60] is set it stores the caller metadata at [this+0x176c] and [this+0x1770] then forwards the field-id list string callback and context into multiplayer_transport_register_field_subscription_bundle; on failure it falls back through multiplayer_transport_enqueue_field_snapshot_record.	ghidra + rizin + llvm-objdump
276	0x0058d9e0	55	multiplayer_transport_send_selector_text	shell	thiscall	inferred	ghidra-headless	3	Sends one caller-supplied text pointer through a selector-specific transport slot. The helper looks up the selector entry from the handler table rooted at [this+0x390] and when both the text pointer and slot are valid forwards the string plus caller flag into the lower send helper at 0x0058e7e0 using the descriptor block at [this+0x80+selector*0x101].	ghidra + rizin + llvm-objdump
277	0x0058da60	75	multiplayer_transport_register_selector_callback	shell	thiscall	inferred	ghidra-headless	3	Registers or dispatches one selector callback against the transport slot table rooted at [this+0x390]. When the selected slot is absent it directly invokes the supplied callback with mode -1 and null payloads; otherwise it packages the caller context on the stack and walks the registered slot through 0x00594ac0 using helper 0x0058da20.	ghidra + rizin + llvm-objdump
278	0x0058db00	23	multiplayer_transport_request_status_pump	shell	thiscall	inferred	ghidra-headless	3	Marks the session-event transport status path dirty by setting [this+0xb44] to 1 and then calling multiplayer_transport_service_status_pump when the transport is active.	ghidra + rizin + llvm-objdump
279	0x0058db20	53	multiplayer_transport_clear_status_pump	shell	thiscall	inferred	ghidra-headless	3	Clears the session-event transport status-pump flag at [this+0xb44] then reruns multiplayer_transport_service_status_pump. When the transport still owns the auxiliary object at [this+0xaf0] it follows up with either 0x00597370 or 0x00597350 depending on whether selector slot [this+0x398] is present.	ghidra + rizin + llvm-objdump
280	0x0058db60	5	multiplayer_transport_force_status_flush	shell	thiscall	inferred	ghidra-headless	3	Tail-call wrapper into 0x00597370 for the active session-event transport object. The shell flush path uses it immediately before multiplayer_transport_flush_and_maybe_shutdown.	ghidra + rizin + llvm-objdump
281	0x0058dc30	22	multiplayer_transport_is_route_mode_active_nonterminal	shell	cdecl	inferred	ghidra-headless	3	Tiny predicate over the route-mode field at [this+0x18b8]. It returns false when the mode is zero or terminal mode `5` and true for the other active route modes. Current grounded callers use it to decide whether route callbacks can run inline or whether route work must be re-enqueued.	ghidra + rizin + llvm-objdump
282	0x0058de90	95	multiplayer_transport_shutdown	shell	thiscall	inferred	ghidra-headless	3	Shuts down the session-event transport object and either marks deferred-close state or tears the object down immediately. It preserves [this+0x178c] across the common shutdown helper at 0x0058de50 disconnects active routes through multiplayer_transport_disconnect and when no outstanding work remains drops into the reset path at 0x0058d8a0; otherwise it latches deferred-close flag [this+0x1ee0].	ghidra + rizin + llvm-objdump
283	0x0058def0	40	multiplayer_transport_flush_and_maybe_shutdown	shell	thiscall	inferred	ghidra-headless	3	Flushes the transport state through 0x0058d8d0 with selector -1 and when deferred-close flag [this+0x1ee0] is set and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.	ghidra + rizin + llvm-objdump
284	0x0058df20	131	multiplayer_transport_submit_text_record	shell	thiscall	inferred	ghidra-headless	3	Submits one prepared text record through the session-event transport using a caller-supplied callback wrapper. The helper allocates a transient transport record through multiplayer_transport_next_work_sequence sends it through multiplayer_transport_try_submit_text_record_fastpath and when that fast path declines packages the caller callback mode and payload into 0x00593170. When the caller requested immediate draining it also services the transport queue through 0x0058d8d0 and 0x0058d720 and may fall into multiplayer_transport_shutdown when deferred close is armed.	ghidra + rizin + llvm-objdump
285	0x0058e100	230	multiplayer_transport_publish_fixed_token_message	shell	thiscall	inferred	ghidra-headless	3	Publishes one fixed-token status message through selector `2` on the session-event transport. The helper requires the transport to be active and fully configured builds a formatted status line from the caller token plus internal fields such as [this+0x282] and [this+0x54] sends that line through multiplayer_transport_send_selector_text sets [this+0xb44] to 1 reruns the status pump and when appropriate nudges the downstream mode helper at 0x00595650 or the auxiliary object paths 0x00597350 and 0x00597370.	ghidra + rizin + llvm-objdump + strings
286	0x0058e200	211	multiplayer_transport_register_callback_table	shell	thiscall	inferred	ghidra-headless	3	Registers or refreshes the session-event transport callback table and descriptor block. When the transport is not yet fully configured it copies the local name into [this+0x04] stores the callback-table pointers at [this+0x4c] and [this+0x5c] sets [this+0x44] active and forwards the descriptor block plus caller metadata into multiplayer_transport_attach_callback_table_descriptor. It then routes the resolved table through multiplayer_transport_dispatch_callback_table_binding and optionally drains queued work through 0x0058d8d0 and 0x0058d720 before honoring deferred-close state.	ghidra + rizin + llvm-objdump
287	0x0058e2e0	38	multiplayer_transport_reset_and_maybe_shutdown	shell	thiscall	inferred	ghidra-headless	3	Resets the common transport state through 0x0058de50 and when deferred-close flag [this+0x1ee0] is armed and the outstanding-work count at [this+0x1808] has reached zero immediately falls into multiplayer_transport_shutdown.	ghidra + rizin + llvm-objdump
288	0x0058e370	33	multiplayer_transport_is_request_pending	shell	cdecl	inferred	ghidra-headless	3	Returns true while the caller transport request still appears in either the queued request collection at [this+0x550] or the secondary active-work collection checked through 0x0059c540. Immediate-drain callers use it as the loop predicate after pumping queued text and sleeping for 10 ms.	ghidra + rizin + llvm-objdump
289	0x0058e3f0	137	multiplayer_transport_drain_request_text_queue	shell	cdecl	inferred	ghidra-headless	3	Immediate-drain helper for one transport request. When request kind [req+0x20] is `1` it walks queued transport text lines under [this+0x1c] republishes them through 0x0059b790 and notifies the small observer table through 0x0058e310 until the queue is empty. When request kind `2` drains it also publishes `Disconnected`. Both paths refresh timeout state through 0x00598030 and finish by forwarding the request into 0x0059c470.	ghidra + rizin + llvm-objdump + strings
290	0x0058e480	105	multiplayer_transport_worker_shutdown_gracefully	shell	cdecl	inferred	rizin	3	Graceful shutdown wrapper for one multiplayer transport worker. If the callback object at `[this+0x538]` and its owner slot `[this+0x544]` are present it first emits a final owner notification through the callback vtable using fallback text at `0x005c87a8`. When the owned text-stream socket at `[this+0x1c]` is still live it appends `QUIT :Later!` through multiplayer_transport_text_stream_append_crlf_line and services one I/O step through multiplayer_transport_text_stream_service_io before destroying the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, the text-stream object at `[this+0x1c]`, and finally the worker backing block itself.	rizin + llvm-objdump + strings
291	0x0058e650	80	multiplayer_transport_sanitize_identifier	shell	cdecl	inferred	ghidra-headless	4	Normalizes a caller-supplied identifier string into the destination buffer by replacing leading punctuation and any later disallowed characters with underscores while preserving acceptable bytes from the source. Current grounded callers use it for the randomized `RT3Player%d` retry name and for locally submitted session-event text records.	ghidra + rizin + llvm-objdump + strings
292	0x0058e6b0	98	multiplayer_transport_set_mode_q_flag	shell	thiscall	inferred	ghidra-headless	4	Updates the transport mode-q flag tracked at [this+0x560]. When the requested value changes it formats either `MODE %s -q` or `MODE %s +q` against the active name buffer at [this+0x36c] stores the new flag and for mode `0` refreshes the downstream callback plumbing through 0x0059e070 and 0x0059de00 using helper 0x0058e6a0.	ghidra + rizin + llvm-objdump + strings
293	0x0058e8c0	37	multiplayer_transport_publish_topic_status_line	shell	thiscall	inferred	ghidra-headless	3	Formats and publishes one `TOPIC %s :%s` status line through the active transport text buffer at [this+0x1c]. When the caller text is null it falls back to the shared empty sample at 0x005c87a8. Current grounded caller is multiplayer_transport_handle_names_query_response.	ghidra + rizin + llvm-objdump + strings
294	0x0058e8f0	56	multiplayer_transport_publish_mode_key_status_line	shell	thiscall	inferred	ghidra-headless	3	Formats and publishes one mode-key status line through the active transport text buffer at [this+0x1c]. Depending on the caller flag it emits either `MODE %s +k %s` or `MODE %s -k %s`. Current grounded caller is multiplayer_transport_handle_bound_route_request.	ghidra + rizin + llvm-objdump + strings
295	0x0058e930	53	multiplayer_transport_publish_mode_level_status_line	shell	thiscall	inferred	ghidra-headless	3	Formats and publishes one mode-level status line through the active transport text buffer at [this+0x1c]. Depending on whether the caller level value is nonzero it emits either `MODE %s +l %d` or `MODE %s -l`. Current grounded caller is multiplayer_transport_handle_names_query_response.	ghidra + rizin + llvm-objdump + strings
296	0x0058e970	36	multiplayer_transport_invoke_registered_name_query_callback	shell	cdecl	inferred	ghidra-headless	3	Small callback shim used by the registered-name fast path. It loads the caller callback object from the dispatch frame and invokes its entry method with success flag `1`; the queried sample string; and the collected callback-entry arrays produced by multiplayer_transport_collect_registered_name_callback_entries.	ghidra + rizin + llvm-objdump
297	0x0058e9a0	177	multiplayer_transport_submit_names_query_with_callback	shell	thiscall	inferred	ghidra-headless	3	Builds and submits one `NAMES %s` query against the active transport text buffer at [this+0x1c]. When the caller sample is already present it bypasses transport submission through multiplayer_transport_dispatch_registered_name_query_fastpath. Otherwise it validates the sample through multiplayer_transport_has_registered_name packages the request through multiplayer_transport_enqueue_names_query_record and when immediate draining is requested loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending. Current grounded callers are multiplayer_transport_handle_bound_route_request and multiplayer_transport_handle_selector_text_route_request.	ghidra + rizin + llvm-objdump + strings
298	0x0058eb70	212	multiplayer_transport_append_getkey_command	shell	cdecl	inferred	rizin	3	Formats one `GETKEY %s %s 0 :` command into a temporary 0x200-byte stack buffer and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. After the fixed header it walks the caller string-vector argument and appends each additional item separated by backslashes. Current grounded caller is the synchronous submit wrapper at 0x0058ec50.	rizin + llvm-objdump + strings
299	0x0058ec50	140	multiplayer_transport_submit_getkey_command_and_wait	shell	cdecl	inferred	rizin	3	Synchronous `GETKEY` submit wrapper for the multiplayer transport worker. It resolves the query name from the caller string or falls back to [this+0x36c] primes one transient request through 0x0058eb30 emits the command text through multiplayer_transport_append_getkey_command and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.	rizin + llvm-objdump + strings
300	0x0058ece0	197	multiplayer_transport_append_setchankey_or_setckey_command	shell	cdecl	inferred	rizin	3	Formats either `SETCHANKEY %s :` or `SETCKEY %s %s :` into a temporary 0x200-byte stack buffer and appends the resulting line to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The two-token `SETCKEY` form is selected when the optional caller key string at arg_210h is present and non-empty; otherwise the helper emits the simpler channel-key form.	rizin + llvm-objdump + strings
301	0x0058edb0	367	multiplayer_transport_append_setchankey_pair_list_command	shell	cdecl	inferred	rizin	2	Builds one larger backslash-delimited channel-key payload and appends it to the owned transport text stream through multiplayer_transport_text_stream_append_crlf_line. The helper formats normalized `\\%s\\%s` pair fragments in a 0x200-byte stack buffer converts backslashes to forward slashes in one staging path handles wildcard samples through the `*` token at 0x005e1e1c and is the main text builder beneath the synchronous submit wrapper at 0x0058ef20.	rizin + llvm-objdump + strings
302	0x0058ef20	199	multiplayer_transport_submit_setchankey_pair_list_command_and_wait	shell	cdecl	inferred	rizin	2	Synchronous channel-key submit wrapper for the multiplayer transport worker. It primes one transient request through 0x0058eb30 emits the larger backslash-delimited key payload through multiplayer_transport_append_setchankey_pair_list_command dispatches the caller result path through 0x005983b0 or 0x005984c0 depending on the staged optional arguments and then loops through multiplayer_transport_drain_request_text_queue system_sleep_milliseconds and multiplayer_transport_is_request_pending until the request completes.	rizin + llvm-objdump + strings
303	0x0058eff0	78	multiplayer_transport_is_valid_nick_string	shell	cdecl	inferred	rizin	4	Validates one transport nick string. It rejects null or empty strings rejects a leading digit or `-` through 0x005a53f2 and then scans every remaining byte against the allowed nick-character table at 0x005e1c70. It returns 1 when the full string is acceptable and 0 otherwise.	rizin + llvm-objdump + strings
304	0x0058f040	90	multiplayer_transport_dispatch_or_release_callback_binding	shell	cdecl	inferred	rizin	3	Generic dispatcher for one optional transport callback-binding structure. When binding field [this+0x0c] is present it packages the caller mode from EDX together with binding fields [this+0x18] and [this+0x36c] into opcode 0x1a through 0x0059b790. Otherwise it clears [this+0x04] and if callback pointer [this+0x14] is installed invokes it directly with the owner cookie at [this+0x18] and a zero status value.	rizin + llvm-objdump + strings
305	0x0058f380	64	tracked_heap_alloc_with_header	support	cdecl	inferred	ghidra-headless	4	Allocates one caller-sized heap block through the shared allocator at 0x005a125d stores the payload size in a 4-byte header immediately before the returned pointer and updates the global allocation counters at 0x00dba4c8 through 0x00dba4d0. Callers treat the returned value as a payload pointer just past the size header.	rizin + llvm-objdump
306	0x0058f3c0	43	tracked_heap_free_with_header	support	cdecl	inferred	ghidra-headless	4	Releases one heap block previously returned by tracked_heap_alloc_with_header. It reads the stored payload size from the 4-byte header decrements the shared allocation counters at 0x00dba4c8 and 0x00dba4cc and frees the underlying base pointer through 0x005a1145.	rizin + llvm-objdump
307	0x0058f3f0	94	tracked_heap_resize_with_header	support	cdecl	inferred	ghidra-headless	4	Resizes one header-tracked heap block to a new payload size. Null plus nonzero size falls through to tracked_heap_alloc_with_header; nonnull plus zero size frees through tracked_heap_free_with_header; and the main path reallocates through 0x005a5922 while preserving and re-accounting the payload size tracked in the 4-byte header.	rizin + llvm-objdump
308	0x0058f460	8	system_sleep_milliseconds	support	cdecl	inferred	ghidra-headless	4	Tiny wrapper over `Sleep` that forwards the caller millisecond delay in `ecx`. Current grounded callers use it as the 10 ms backoff inside immediate transport-drain loops.	rizin + llvm-objdump
309	0x005928a0	189	multiplayer_transport_enqueue_opcode_record	shell	cdecl	inferred	ghidra-headless	3	Common allocator and queue-submit helper for session-event transport opcode records. It allocates a zeroed caller-sized record through tracked_heap_alloc_with_header invokes the opcode-specific initializer from the handler table at 0x005e2004 plus opcode times 0x10 packages the resulting payload together with caller metadata into 0x0059e4d0 and increments [this+0x1800] on success. Allocation or initializer failure releases the temporary record through tracked_heap_free_with_header and returns -1.	ghidra + rizin + llvm-objdump
310	0x00592a40	40	multiplayer_transport_dispatch_callback_table_binding	shell	cdecl	inferred	ghidra-headless	2	Small binding-dispatch wrapper over multiplayer_transport_enqueue_opcode_record with opcode `4`. Current grounded callers use it after preparing callback-table descriptor fields from a live transport registration object and then continue through the common transport cleanup or release path.	ghidra + rizin + llvm-objdump
311	0x00592a70	109	multiplayer_transport_probe_or_enqueue_route_record	shell	cdecl	inferred	ghidra-headless	2	Small route-probe wrapper over multiplayer_transport_enqueue_opcode_record. It first calls multiplayer_transport_is_route_mode_active_nonterminal and when that succeeds with caller mode `2` directly invokes the supplied callback; otherwise it falls back to an 0x08-byte opcode `1` record built from the caller callback and payload fields.	ghidra + rizin + llvm-objdump
312	0x00592ae0	111	multiplayer_transport_enqueue_descriptor_block_record	shell	cdecl	inferred	ghidra-headless	2	Copies one caller-supplied seven-dword descriptor block into a local buffer and enqueues it through multiplayer_transport_enqueue_opcode_record as a 0x1c-byte opcode `2` record. Current grounded callers come from the deeper callback-table registration path.	ghidra + rizin + llvm-objdump
313	0x00592b50	226	multiplayer_transport_enqueue_field_snapshot_record	shell	cdecl	inferred	ghidra-headless	3	Builds and enqueues one field-snapshot transport record through multiplayer_transport_enqueue_opcode_record using opcode `3` and a 0x14-byte payload. Depending on the caller mode it can first remove prior matching entries through 0x005929f0 then normalizes the `hostname` field against `(No Name)` samples the `gamemode` field and compares it against `openstaging` computes a 0 to 100 progress scalar from counters around [this+0x1734] [this+0x1740] and [this+0x1774] and packages the subscribed callback pointers from [this+0x176c] and [this+0x1770].	ghidra + rizin + llvm-objdump + strings
314	0x00592c40	54	multiplayer_transport_enqueue_callback_binding_record	shell	cdecl	inferred	ghidra-headless	2	Builds and enqueues one 0x08-byte opcode `4` callback-binding record through multiplayer_transport_enqueue_opcode_record. The helper uses the registered callback-table pointer at [this+0x4c] and is the direct worker beneath multiplayer_transport_dispatch_callback_table_binding.	ghidra + rizin + llvm-objdump
315	0x00592c80	80	multiplayer_transport_enqueue_callback_slot9_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that enqueues one 0x10-byte opcode `9` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1790] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
316	0x00592cd0	85	multiplayer_transport_enqueue_callback_slot10_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that enqueues one 0x14-byte opcode `10` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1794] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
317	0x00592d30	62	multiplayer_transport_enqueue_callback_slot11_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that enqueues one 0x04-byte opcode `11` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x1798] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
318	0x00592d70	77	multiplayer_transport_enqueue_callback_slot12_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that copies a caller-supplied seven-dword block and enqueues it as a 0x20-byte opcode `12` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x179c] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
319	0x00592dc0	72	multiplayer_transport_enqueue_callback_slot13_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that enqueues one 0x0c-byte opcode `13` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a0] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
320	0x00592e10	72	multiplayer_transport_enqueue_callback_slot14_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that enqueues one 0x10-byte opcode `14` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a4] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
321	0x00592e60	64	multiplayer_transport_enqueue_callback_slot15_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that enqueues one 0x08-byte opcode `15` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17a8] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
322	0x00592ea0	64	multiplayer_transport_enqueue_callback_slot16_record	shell	cdecl	inferred	ghidra-headless	2	Gated callback-slot wrapper that enqueues one 0x08-byte opcode `16` record through multiplayer_transport_enqueue_opcode_record when byte [this+0x17ac] is set. The record is built around the callback-side state rooted near [this+0x17f8].	ghidra + rizin + llvm-objdump
323	0x00593460	87	multiplayer_transport_mark_selector_slot_records_stale	shell	cdecl	inferred	ghidra-headless	3	Scans the queued transport request collection at [this+0x1780] for records of type `1` or `2` whose selector-slot field at +0x1c matches the requested slot id. Matching records are marked stale by setting byte or dword field +0x38 to one. Current grounded caller is multiplayer_transport_reset_selector_slot.	ghidra + rizin + llvm-objdump
324	0x00593790	351	multiplayer_transport_handle_names_query_response	shell	cdecl	inferred	ghidra-headless	3	Completion callback for multiplayer_transport_submit_names_query_with_callback. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can update route-binding state through multiplayer_transport_is_route_mode_active_nonterminal and multiplayer_transport_try_connect_status_route_once seeds selector slot `2` through multiplayer_transport_init_selector_slot upserts returned name records through multiplayer_transport_upsert_selector_name_entry publishes `TOPIC` and `MODE` lines through multiplayer_transport_publish_topic_status_line and multiplayer_transport_publish_mode_level_status_line and may promote one deferred route binding into [this+0x1ec8]. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.	ghidra + rizin + llvm-objdump + strings
325	0x005938f0	145	multiplayer_transport_handle_bound_route_request	shell	cdecl	inferred	ghidra-headless	3	Completion callback for multiplayer_transport_submit_bound_route_request. If the request is already stale at +0x38 it just unlinks through 0x5933a0. On nonzero result it can publish [req+0x24] through multiplayer_transport_publish_mode_key_status_line and then schedules multiplayer_transport_handle_names_query_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot `2` and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.	ghidra + rizin + llvm-objdump
326	0x00594690	76	multiplayer_transport_mark_selector_slot_views_dirty	shell	cdecl	inferred	ghidra-headless	2	Marks one selector slot dirty in the transport-side view state rooted at [this+0xac8]. It sets slot-specific dirty bits at +0xa0 and +0xa4 when backing arrays at [this+0xad0] or [this+0xadc] are populated and also sets +0xa8 for selector slot `2`. Current grounded callers are multiplayer_transport_set_selector_slot_flags and multiplayer_transport_upsert_selector_name_entry.	ghidra + rizin + llvm-objdump
327	0x00594bd0	97	multiplayer_transport_set_selector_slot_flags	shell	cdecl	inferred	ghidra-headless	3	Updates one selector-slot flag dword at [entry+0x5c] after resolving the current selector entry through 0x00594a40. When selector index `2` flips bit `1` it forwards the new bit value through multiplayer_transport_enqueue_callback_slot15_record and then notifies the shared selector-change callback path through 0x00593250 with selector id old flags and new flags.	ghidra + rizin + llvm-objdump
328	0x00594c40	103	multiplayer_transport_parse_selector_mode_letters	shell	cdecl	inferred	ghidra-headless	3	Parses one selector-mode letter string into a small bitmask by probing for the letters `s` `r` `g` `a` and `h`. Current grounded callers merge this mask into the selector-slot flags that live at [entry+0x5c].	ghidra + rizin + llvm-objdump + strings
329	0x00594cb0	65	multiplayer_transport_merge_selector_mode_mask	shell	cdecl	inferred	ghidra-headless	3	Resolves one selector entry through 0x00594a40 parses the caller mode-letter string through multiplayer_transport_parse_selector_mode_letters preserves the current presence bits 0x20 and 0x40 from [entry+0x5c] and commits the merged result through multiplayer_transport_set_selector_slot_flags.	ghidra + rizin + llvm-objdump + strings
330	0x00594d00	72	multiplayer_transport_set_selector_presence_mask	shell	cdecl	inferred	ghidra-headless	3	Overwrites the selector presence bits 0x20 and 0x40 in [entry+0x5c] from one caller byte mask while preserving the rest of the selector-slot flags. The helper then commits the new value through multiplayer_transport_set_selector_slot_flags.	ghidra + rizin + llvm-objdump
331	0x00594f20	142	multiplayer_transport_upsert_selector_name_entry	shell	cdecl	inferred	ghidra-headless	3	Looks up or creates one selector-name entry for the requested selector slot. It resolves the current slot entry through 0x594a40 allocates a new entry through 0x594e70 when no match exists marks the selector index active at [entry+0x40+slot*4] increments the per-slot generation counter at [this+0xab8+slot*4] applies the caller flag bits 0x20 and 0x40 into [entry+0x5c+slot*4] and then marks the slot views dirty through multiplayer_transport_mark_selector_slot_views_dirty. Current grounded callers come from multiplayer_transport_handle_names_query_response and multiplayer_transport_handle_selector_update_response.	ghidra + rizin + llvm-objdump
332	0x005950d0	101	multiplayer_transport_reset_selector_tables	shell	cdecl	inferred	ghidra-headless	4	Resets the three selector registration tables rooted at [this+0x80] [this+0x390] and [this+0x39c] together with state at [this+0x9a8] and [this+0x9ac]. When [this+0xab0] is set it preserves selector slot `0`; otherwise it clears all three selector slots.	ghidra + rizin + llvm-objdump
333	0x00595140	89	multiplayer_transport_set_selector_name	shell	cdecl	inferred	ghidra-headless	4	Copies one selector name into the fixed 0x101-byte selector-name slot at [this+0x80+index*0x101] when the caller string fits. It then marks the selector present at [this+0x384+index*4] and clears the paired transient pointer at [this+0x99c+index*4].	ghidra + rizin + llvm-objdump
334	0x005951a0	67	multiplayer_transport_find_selector_name	shell	cdecl	inferred	ghidra-headless	4	Scans the three selector-name slots rooted at [this+0x80] for an exact string match and returns the matching selector index through the caller pointer. The callback-slot wrapper family uses this helper before enqueueing several selector-bound opcode records.	ghidra + rizin + llvm-objdump
335	0x005951f0	579	multiplayer_transport_service_status_pump	shell	cdecl	inferred	ghidra-headless	3	Central session-event transport status-pump and route-service loop. It inspects selector presence under [this+0x384] and [this+0x390] builds temporary selector-mode masks through multiplayer_transport_parse_selector_mode_letters emits status text and field updates through multiplayer_transport_append_setchankey_or_setckey_command multiplayer_transport_dispatch_field_snapshot_mode and related helpers and drives the deeper route-state machine through multiplayer_transport_init_selector_slot multiplayer_transport_reset_selector_slot 0x005965d0 0x0059f3c0 and related helpers.	ghidra + rizin + llvm-objdump + strings
336	0x00595440	98	multiplayer_transport_init_selector_slot	shell	cdecl	inferred	ghidra-headless	3	Initializes one selector slot under [this+0x384] and [this+0x390]. It copies caller text or the default sample at 0x005c87a8 into the fixed selector buffer at [slot+0x39c] clears byte [slot+0x59b] reruns multiplayer_transport_service_status_pump and then notifies multiplayer_transport_submit_profile_key_query_bundle_default for the refreshed selector slot.	ghidra + rizin + llvm-objdump + strings
337	0x005954b0	238	multiplayer_transport_reset_selector_slot	shell	cdecl	inferred	ghidra-headless	3	Resets one selector slot under [this+0x384] and [this+0x390]. When the slot is active it tears the current selector object down through 0x593460 optionally republishes caller text through 0x58e7a0 refreshes selector bookkeeping through 0x5950a0 and clears the active and present flags before returning.	ghidra + rizin + llvm-objdump
338	0x00595620	35	multiplayer_transport_release_route_binding	shell	cdecl	inferred	ghidra-headless	3	Releases the current route binding stored at [this+0x1ec8]. It detaches the binding from the descriptor object at [this+0x1ed0] through 0x58f3c0 unlinks it through 0x5933a0 and clears [this+0x1ec8].	ghidra + rizin + llvm-objdump
339	0x00595650	688	multiplayer_transport_set_route_mode	shell	cdecl	inferred	ghidra-headless	3	Main route-mode state machine for the session-event transport. It latches the requested small mode at [this+0x18b8] and dispatches modes `0` through `5` across live-route teardown selector-slot init or reset am-rating route seeding live-route connect and route-binding release paths. The branch uses multiplayer_transport_release_live_route multiplayer_transport_try_seed_am_rating_route_table multiplayer_transport_try_connect_live_route and multiplayer_transport_release_route_binding to converge on the next stable mode.	ghidra + rizin + llvm-objdump + strings
340	0x005958e0	156	multiplayer_transport_try_stage_route_callback_payload	shell	cdecl	inferred	ghidra-headless	2	Builds one staged route-callback payload from the caller route object and transport-local text buffer at [this+0x60]. It extracts several caller fields through the 0x58d1f0 0x58d240 0x58d220 and 0x58d250 or 0x58d200 helpers packs them through multiplayer_transport_format_gsp_payload submits the staged text through multiplayer_transport_submit_selector_text_route_request and on success stores the cloned callback payload returned by multiplayer_transport_clone_staged_callback_payload at [this+0xb50].	ghidra + rizin + llvm-objdump + strings
341	0x00595980	84	multiplayer_transport_handle_route_status_result	shell	cdecl	inferred	ghidra-headless	2	Completion callback used by multiplayer_transport_submit_route_status_request. When the callback result is nonzero it compares the live status counters at [this+0xac0] and [this+0xb48] and advances the route-mode state machine through mode `2` or modes `3` or `4`. When the callback result is zero it sets [this+0x1ed8] and re-enters multiplayer_transport_set_route_mode using the current am-rating route state at [this+0x1ed4].	ghidra + rizin + llvm-objdump
342	0x005959e0	81	multiplayer_transport_submit_route_status_request	shell	cdecl	inferred	ghidra-headless	3	Submits one route-status request for the current binding at [this+0x1ec8]. It gathers the binding fields at +0x2c and +0x30 together with the local counter at [this+0xb48] and default sample text at 0x005c87a8 then sends that request through 0x593980 using multiplayer_transport_handle_route_status_result as the completion callback. Failure sets [this+0x1ed8] so the route-mode setter can fall back immediately.	ghidra + rizin + llvm-objdump
343	0x00596270	70	multiplayer_transport_clone_staged_callback_payload	shell	cdecl	inferred	ghidra-headless	3	Clones one staged route-callback payload block by allocating a same-sized object through 0x58d5b0 copying the first nine dwords and then registering a cleanup callback through 0x58fa00 with shim 0x596260. Current grounded caller is multiplayer_transport_try_stage_route_callback_payload.	ghidra + rizin + llvm-objdump
344	0x00597720	96	multiplayer_transport_format_gsp_payload	shell	cdecl	inferred	ghidra-headless	3	Formats one transport text payload with the `#GSP!%s!%c%s%c` template at 0x005e2358. Depending on whether the global formatter state at 0x00dba4c4 is present it builds either a 0x58-byte or 0x4d-byte intermediate fragment through 0x597590 or 0x5976c0 and then emits the final string through 0x5a19c4. Current grounded callers are multiplayer_transport_submit_bound_route_request and multiplayer_transport_try_stage_route_callback_payload.	ghidra + rizin + llvm-objdump + strings
345	0x00593980	382	multiplayer_transport_submit_bound_route_request	shell	cdecl	inferred	ghidra-headless	3	Builds and submits one bound-route request using the current transport text buffers and a caller-supplied binding id or fallback route id. It formats the request payload through multiplayer_transport_format_gsp_payload allocates a type `1` transient request record through 0x5934e0 stores route and callback metadata on that record publishes selector `2` text through multiplayer_transport_set_selector_name and finally submits the request through 0x58e720 using multiplayer_transport_handle_bound_route_request. A nonempty caller text sample sets [this+0xb4c].	ghidra + rizin + llvm-objdump + strings
346	0x00593b00	161	multiplayer_transport_handle_selector_update_response	shell	cdecl	inferred	ghidra-headless	3	Follow-up callback used by multiplayer_transport_handle_selector_text_route_request. When the callback succeeds it initializes or repopulates selector slot [req+0x1c] through multiplayer_transport_init_selector_slot and multiplayer_transport_upsert_selector_name_entry. When it fails it resets that selector slot. Both paths finish by enqueueing a route record through multiplayer_transport_probe_or_enqueue_route_record and unlinking the request through 0x5933a0.	ghidra + rizin + llvm-objdump
347	0x00593bb0	144	multiplayer_transport_handle_selector_text_route_request	shell	cdecl	inferred	ghidra-headless	3	Completion callback for multiplayer_transport_submit_selector_text_route_request. If the request is already stale at +0x38 it clears the transient state through 0x5962c0 and unlinks the request. On nonzero result it schedules multiplayer_transport_handle_selector_update_response through multiplayer_transport_submit_names_query_with_callback. On zero result it resets selector slot [req+0x1c] and falls back to multiplayer_transport_probe_or_enqueue_route_record before unlinking the request.	ghidra + rizin + llvm-objdump
348	0x00593c40	177	multiplayer_transport_submit_selector_text_route_request	shell	cdecl	inferred	ghidra-headless	3	Builds and submits one selector-text route request. It validates the caller text defaults the sample text to 0x005c87a8 allocates a type `2` transient request record through 0x5934e0 stores the selector id at +0x1c refreshes selector naming through 0x59fc80 and multiplayer_transport_set_selector_name and then submits the request through 0x58e720 using multiplayer_transport_handle_selector_text_route_request.	ghidra + rizin + llvm-objdump + strings
349	0x00595a40	245	multiplayer_transport_dispatch_field_snapshot_mode	shell	cdecl	inferred	ghidra-headless	3	Dispatches several session-field snapshot update modes into multiplayer_transport_enqueue_field_snapshot_record. Depending on the mode it can enqueue hostname or gamemode snapshots clear the progress scalar at [this+0x1774] reset the callback payload to zero or copy one dword from [eax+0x490] into [this+0x54] while updating the local field cache rooted at [this+0x1724].	ghidra + rizin + llvm-objdump + strings
350	0x00595b60	25	multiplayer_transport_enqueue_field_snapshot_mode1_if_enabled	shell	cdecl	inferred	ghidra-headless	2	Tiny field-snapshot wrapper that enqueues one mode-1 field snapshot only when the caller enable flag is zero. The helper is a thin front end over multiplayer_transport_enqueue_field_snapshot_record.	ghidra + rizin + llvm-objdump
351	0x00595b80	50	multiplayer_transport_clear_progress_field_cache	shell	cdecl	inferred	ghidra-headless	3	Clears the progress-related field cache rooted at [this+0xba0] and then clears the local field cache at [this+0x1724]. It finishes by forwarding mode `3` into 0x005929a0 to remove the matching queued field-snapshot records.	ghidra + rizin + llvm-objdump + strings
352	0x00595bc0	272	multiplayer_transport_enqueue_capacity_descriptor_record	shell	cdecl	inferred	ghidra-headless	3	Builds and enqueues one descriptor-block transport record tied to the capacity or progress cache at [this+0x1778]. One branch forwards cached descriptor fields directly through multiplayer_transport_enqueue_descriptor_block_record while the live branch samples hostname openstaging gamemode and numplayers strings from the current transport object before enqueueing the same opcode-2 descriptor record.	ghidra + rizin + llvm-objdump + strings
353	0x00595ce0	22	multiplayer_transport_clear_capacity_descriptor_cache	shell	cdecl	inferred	ghidra-headless	3	Clears the auxiliary capacity-descriptor cache when [this+0xba0] is present by forwarding the embedded object at [this+0xba4] into 0x00590740. Current grounded callers use this before disconnect or larger route-state cleanup.	ghidra + rizin + llvm-objdump
354	0x00595d60	84	multiplayer_transport_check_openstaging_capacity_gate	shell	cdecl	inferred	ghidra-headless	2	Checks whether the current transport object still matches the cached openstaging-like descriptor and whether numplayers remains below maxplayers. When the cached route object at [this+0x1ecc] already matches the current transport identifiers it returns success immediately; otherwise it compares the current maxplayers and numplayers fields and on success falls into 0x00592710 for the caller's route transition path.	ghidra + rizin + llvm-objdump + strings
355	0x00595dc0	79	multiplayer_transport_try_transition_after_capacity_gate	shell	cdecl	inferred	ghidra-headless	2	Rejects when [this+0x1e8c] or selector slot [this+0x38c] is busy then runs multiplayer_transport_check_openstaging_capacity_gate refreshes route-side state through 0x5973b0 and 0x5954b0 forwards the caller event into 0x5958e0 and on success transitions through 0x595650 mode `0`.	ghidra + rizin + llvm-objdump
356	0x00595e10	321	multiplayer_transport_dispatch_route_event_mode	shell	cdecl	inferred	ghidra-headless	2	Dispatches route-event modes for the callback branch rooted at [this+0x18bc]. Depending on the mode it may update [this+0x18bc] or [this+0x1e7c] reuse multiplayer_transport_try_transition_after_capacity_gate force mode `2` through 0x595650 or copy a selected descriptor pointer into [this+0x54]. Current surrounding evidence ties this branch to the `gsi_am_rating` route table.	ghidra + rizin + llvm-objdump
357	0x00595f70	237	multiplayer_transport_dispatch_am_rating_route_callback	shell	cdecl	inferred	ghidra-headless	3	Callback handler for the `gsi_am_rating` route branch rooted at [this+0x18bc]. Mode `0` forwards directly into multiplayer_transport_try_transition_after_capacity_gate while mode `2` prunes stale route entries against multiplayer_transport_check_openstaging_capacity_gate updates surviving entries through 0x58d130 with the `gsi_am_rating` token and either forces mode `2` or forwards the surviving head entry into 0x5958e0 before transitioning through 0x595650 mode `0`.	ghidra + rizin + llvm-objdump + strings
358	0x00596060	48	multiplayer_transport_reset_am_rating_route_state	shell	cdecl	inferred	ghidra-headless	3	Small reset helper for the active `gsi_am_rating` route state. When [this+0xba0] is set it clears the route callback table at [this+0x18bc] resets [this+0x1ec4] to zero and clears the auxiliary route cache at [this+0x1e7c].	ghidra + rizin + llvm-objdump + strings
359	0x00596090	272	multiplayer_transport_init_route_callback_tables	shell	cdecl	inferred	ghidra-headless	3	Initializes route callback tables at [this+0xba4] [this+0x1724] [this+0x1164] [this+0x18bc] and [this+0x1e7c]. Installs handlers 0x00595a40 0x00595b60 0x00595bc0 0x00595e10 and multiplayer_transport_dispatch_am_rating_route_callback seeds default selector text from static tables and sets [this+0xba0].	ghidra + rizin + llvm-objdump
360	0x005961b0	92	multiplayer_transport_teardown_route_callback_tables	shell	cdecl	inferred	ghidra-headless	4	Clears progress and capacity caches destroys the callback tables at [this+0xba4] [this+0x1164] and [this+0x18bc] clears the related caches at [this+0x1724] and [this+0x1e7c] and resets [this+0x1ec4] to zero.	ghidra + rizin + llvm-objdump
361	0x005962e0	583	multiplayer_transport_register_field_subscription_bundle	shell	cdecl	inferred	ghidra-headless	3	Builds one field-subscription bundle from the field-id list optional suffix text and selector-name table. Rebuilds the callback table at [this+0xba4] seeds the local field cache at [this+0x1724] installs the subscription block through 0x590ed0 sets [this+0x1774] on success and enqueues an immediate mode-3 field snapshot through multiplayer_transport_enqueue_field_snapshot_record.	ghidra + rizin + llvm-objdump
362	0x00596530	101	multiplayer_transport_try_seed_am_rating_route_table	shell	cdecl	inferred	ghidra-headless	2	Used by the larger route-mode setter around 0x595650. It first calls multiplayer_transport_reset_am_rating_route_state then rebuilds one mode `4` route entry in the callback table at [this+0x18bc] from the stored descriptor at [this+0x1ed0]. Success clears [this+0x1ed4] sets [this+0x1ec4] to one and failure reverts through multiplayer_transport_reset_am_rating_route_state before setting [this+0x1ed4].	ghidra + rizin + llvm-objdump + strings
363	0x005965a0	44	multiplayer_transport_try_connect_status_route_once	shell	cdecl	inferred	ghidra-headless	3	Single-shot wrapper for the auxiliary status-route object at [this+0xaf0]. When the in-flight latch at [this+0xb40] is already set it returns false immediately. Otherwise it sets that latch and forwards the caller route id into multiplayer_transport_try_connect_status_route then booleanizes the result. Current grounded caller is multiplayer_transport_handle_names_query_response.	ghidra + rizin + llvm-objdump
364	0x00596da0	497	multiplayer_transport_submit_profile_key_query_bundle	shell	cdecl	inferred	rizin	2	Wrapper above the transport key-command builders that stages a small named-key query bundle around the strings `username` and `b_flags`. It allocates temporary key-name arrays and callback-entry tables submits the first request through multiplayer_transport_submit_getkey_command_and_wait folds returned key results into transport-owned callback state through 0x0058f8f0 and 0x0058fa00 and then follows with the larger channel-key submission path through multiplayer_transport_submit_setchankey_pair_list_command_and_wait when the staged key set is nonempty.	rizin + llvm-objdump + strings
365	0x00596fa0	19	multiplayer_transport_submit_profile_key_query_bundle_with_context	shell	cdecl	inferred	rizin	2	Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector or route context in `edx` and forwards the stack-supplied context pointer as the extra bundle argument. Current grounded use is through the local callback table rooted at 0x0059f8b0.	rizin + llvm-objdump
366	0x00596fc0	14	multiplayer_transport_submit_profile_key_query_bundle_default	shell	cdecl	inferred	rizin	3	Thin wrapper over multiplayer_transport_submit_profile_key_query_bundle that preserves the caller selector slot in `edx` and forces a null extra-context argument. Current grounded caller is multiplayer_transport_init_selector_slot and the same wrapper is also installed through the local callback table rooted at 0x0059fb60.	rizin + llvm-objdump
367	0x00596fd0	441	multiplayer_transport_dispatch_status_route_event	shell	cdecl	inferred	rizin	3	Main local callback dispatcher for the auxiliary status-route object. It gates on [this+0x398] [this+0xb44] and flag bits in [this+0xb38] then maps route event ids through the local table at 0x005970c4 into selector text publication openstaging publication boolean status publication and callback forwarding paths. The dispatcher publishes through multiplayer_transport_send_selector_text and multiplayer_transport_publish_fixed_token_message and can also invoke the owner callback at [this+0x17dc] with payload [this+0x17f8].	rizin + llvm-objdump + strings
368	0x00597350	30	multiplayer_transport_release_status_route	shell	cdecl	inferred	ghidra-headless	3	Releases the auxiliary status-route object stored at [this+0xaf0] through 0x58cfd0 and clears the owner slot afterward. Status-pump cleanup fixed-token publishing and the auxiliary route connect helper use this before rebuilding status-route state.	ghidra + rizin + llvm-objdump
369	0x005973d0	170	multiplayer_transport_try_connect_status_route	shell	cdecl	inferred	ghidra-headless	3	Attempts to connect or rebuild the auxiliary status-route object at [this+0xaf0]. It first tears any existing status route down through multiplayer_transport_release_status_route then builds a callback table from the local handler set rooted at multiplayer_transport_dispatch_status_route_event through 0x5972c0 chooses either the default route id `0x1964` or the caller route id and connects through 0x58cc40 or 0x58c9b0. On success it copies [this+0x9a8] into [this+0xb3c] wires the created route object through 0x58bc90 using callback 0x597330 and clears [this+0xb38].	ghidra + rizin + llvm-objdump + strings
370	0x005973b0	30	multiplayer_transport_release_live_route	shell	cdecl	inferred	ghidra-headless	4	Releases the current live route object stored at [this+0x1ecc] through 0x58cfd0 and clears the owner slot afterward. The route-mode setter and connect helper use it before rebuilding or switching live route state.	ghidra + rizin + llvm-objdump
371	0x00597480	261	multiplayer_transport_try_connect_live_route	shell	cdecl	inferred	ghidra-headless	3	Attempts to connect or rebuild the current live route object at [this+0x1ecc]. It first clears any existing live route through multiplayer_transport_release_live_route then formats a local identifier from [this+0x60] and 0x005dccfc chooses either the default route id `0x1964` or the binding-specific id and connects through 0x58cc40 or 0x58c9b0. On success it updates [this+0x1ed8] and preserves the new live route state for the route-mode setter.	ghidra + rizin + llvm-objdump + strings
372	0x00598230	67	multiplayer_transport_enqueue_names_query_record	shell	cdecl	inferred	ghidra-headless	3	Allocates one 0x10-byte transient names-query work item zeroes its four dword fields and submits it through 0x5980f0 as request kind `3` using the caller-provided sample or callback context pointer. The helper returns the allocated work item on success and null on allocation or submit failure. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.	ghidra + rizin + llvm-objdump
373	0x0058f0a0	99	multiplayer_transport_append_user_and_optional_nick_commands	shell	cdecl	inferred	rizin	3	Builds the initial identity command bundle for one multiplayer transport worker. It appends `USER %s %s %s :%s` to the owned text stream using worker text fields at [this+0x3ac] [this+0x42c] and [this+0x4b0] together with the fallback host `127.0.0.1` then checks the current nick through multiplayer_transport_is_valid_nick_string and either falls through multiplayer_transport_dispatch_or_release_callback_binding with mode `1` or appends `NICK %s` directly through the same text-stream path.	rizin + llvm-objdump + strings
374	0x0058f920	72	hashed_entry_table_upsert	support	cdecl	inferred	rizin	4	Generic hashed-entry-table upsert over a bucket array of contiguous vectors. It computes the bucket index through the table hash callback at [this+0x0c] looks for an existing matching entry through hashed_entry_table_lookup and when found overwrites that slot through generic_vector_overwrite_with_callback; otherwise it appends the caller record into the selected bucket vector through 0x0059e4d0.	rizin + llvm-objdump
375	0x0058f970	69	hashed_entry_table_remove	support	cdecl	inferred	rizin	4	Generic hashed-entry-table remove over a bucket array of contiguous vectors. It hashes the caller key into one bucket and erases the matching slot through generic_vector_erase_with_callback when present; otherwise it returns false.	rizin + llvm-objdump
376	0x0058f9c0	63	hashed_entry_table_lookup	support	cdecl	inferred	rizin	4	Generic hashed-entry-table lookup over a bucket array of contiguous vectors. It hashes the caller key into one bucket resolves the matching index through generic_vector_find_index and returns the matched entry pointer or null.	rizin + llvm-objdump
377	0x0058f110	465	multiplayer_transport_worker_init	shell	cdecl	inferred	rizin	3	Initializes one heap-backed multiplayer transport worker and its owned text-stream and store state. It zeroes the `0x5e4`-byte worker copies caller identifier strings into the fixed buffers at `[this+0x00]`, `[this+0x36c]`, `[this+0x3ac]`, `[this+0x42c]`, and `[this+0x4b0]`, copies one 5-dword descriptor block into `[this+0x534]`, seeds the state fields at `[this+0x04]` and `[this+0x558]`, initializes the registered-name store at `[this+0x548]`, the pending-template dispatch store at `[this+0x54c]`, and the owned text-stream object at `[this+0x1c]`, and tears partial state back down on failure.	rizin + llvm-objdump
378	0x0058f2f0	60	multiplayer_transport_worker_create	shell	cdecl	inferred	rizin	3	Thin allocation wrapper for multiplayer_transport_worker_init. It allocates one `0x5e4`-byte worker block through tracked_heap_alloc_with_header and then forwards the descriptor pointer already staged in `EDX` plus the caller argument bundle into multiplayer_transport_worker_init.	rizin + llvm-objdump
379	0x0059d430	47	string_hash_sum_mod	support	cdecl	inferred	rizin	3	Small string-hash helper that accumulates one normalized integer value per input byte through 0x005a5900 and returns the running sum modulo the caller divisor. Current grounded callers use it as the bucket-selector callback for registered-name entry tables.	rizin + llvm-objdump
380	0x0059d470	57	multiplayer_transport_lookup_registered_name	shell	cdecl	inferred	ghidra-headless	3	Copies one caller string into a stack-local buffer and looks it up against the registered-name store rooted at [this+0x548] through hashed_entry_table_lookup. It returns the matched entry pointer or null. Current grounded callers are multiplayer_transport_has_registered_name and the deeper names-query payload helper family.	ghidra + rizin + llvm-objdump
381	0x0059d520	91	multiplayer_transport_init_registered_name_store	shell	thiscall	inferred	rizin	4	Initializes the transport-side registered-name store by allocating the hashed bucket table at [this+0x548] with 7 buckets and a 0x1e0-byte entry shape through 0x0058f840 and then allocating the companion flat entry vector at [this+0x54c] through 0x0059e0b0. On allocation failure it tears any partial state back down.	rizin + llvm-objdump
382	0x0059d580	35	multiplayer_transport_destroy_registered_name_store	shell	thiscall	inferred	rizin	4	Destroys the transport-side registered-name store by releasing the hashed bucket table at [this+0x548] through 0x0058f8b0 and the companion flat entry vector at [this+0x54c] through generic_vector_destroy when present.	rizin + llvm-objdump
383	0x0059d610	81	multiplayer_transport_contains_registered_name_entry	shell	cdecl	inferred	rizin	3	Linear membership check over the flat registered-name entry vector at [this+0x54c]. It compares each live entry against the caller key through 0x005a57cf and returns true on the first exact match.	rizin + llvm-objdump
384	0x0059d670	240	multiplayer_transport_upsert_registered_name_entry	shell	cdecl	inferred	rizin	3	Builds one temporary 0x1e0-byte registered-name entry on the stack from the caller descriptor and name string; allocates the entry-owned callback table through 0x0058f840; removes any older flat-vector entry with the same key from [this+0x54c]; and then inserts or replaces the canonical entry in the hashed registered-name store at [this+0x548] through hashed_entry_table_upsert.	rizin + llvm-objdump
385	0x0059d760	103	multiplayer_transport_remove_registered_name_entry	shell	cdecl	inferred	rizin	4	Copies the caller name into a stack-local temporary key; removes any matching entry from the flat registered-name vector at [this+0x54c]; and then removes the canonical hashed-store entry from [this+0x548] through hashed_entry_table_remove.	rizin + llvm-objdump
386	0x0058fa00	49	generic_callback_list_for_each	support	cdecl	inferred	ghidra-headless	4	Generic callback-list walker over one `[items count]` style callback collection. It uses generic_vector_for_each to visit every entry pointer and forwards the caller context through the supplied callback shim unchanged. Transport registration and the registered-name fast path reuse it to fan out one callback over all registered entries.	rizin + llvm-objdump
387	0x0059e110	3	generic_vector_count	support	cdecl	inferred	rizin	4	Returns the current element count from dword [this+0x00] for one contiguous vector-style container.	rizin + llvm-objdump
388	0x0059e120	10	generic_vector_index_ptr	support	cdecl	inferred	rizin	4	Computes one element pointer as base [this+0x14] plus index times stride [this+0x08]. Most higher-level vector helpers funnel slot access through this helper.	rizin + llvm-objdump
389	0x0059e130	58	generic_vector_erase	support	cdecl	inferred	rizin	4	Removes one indexed element from a contiguous vector. When the erased slot is not already the tail it memmoves the trailing span down and then decrements the element count at [this+0x00].	rizin + llvm-objdump
390	0x0059e170	21	generic_vector_sort	support	cdecl	inferred	rizin	4	Sorts the backing element range at [this+0x14] through the shared qsort-style helper using the current count and stride from the vector header.	rizin + llvm-objdump
391	0x0059e190	49	generic_vector_for_each	support	cdecl	inferred	rizin	4	Forward iterator for one contiguous vector. It walks indices `0..count-1` resolves each slot through generic_vector_index_ptr and invokes the caller callback with the shared context argument.	rizin + llvm-objdump
392	0x0059e1d0	42	generic_vector_for_each_reverse	support	cdecl	inferred	rizin	4	Reverse iterator for one contiguous vector. It walks indices `count-1..0` and invokes the caller callback on each resolved slot pointer.	rizin + llvm-objdump
393	0x0059e200	61	generic_vector_find_first	support	cdecl	inferred	rizin	4	Scans the vector from the front and returns the first element pointer whose caller predicate returns zero. When no match is found it returns null.	rizin + llvm-objdump
394	0x0059e2f0	19	generic_vector_invoke_element_callback	support	cdecl	inferred	rizin	4	Invokes the optional per-element callback stored at [this+0x10] for one indexed slot when that callback pointer is nonnull. Erase overwrite and destroy helpers reuse it before mutating storage.	rizin + llvm-objdump
395	0x0059e310	31	generic_vector_store_at	support	cdecl	inferred	rizin	4	Copies one caller-supplied element record into the indexed slot resolved through generic_vector_index_ptr using the current element stride from the vector header.	rizin + llvm-objdump
396	0x0059e330	49	generic_vector_destroy	support	cdecl	inferred	rizin	4	Walks all live elements through generic_vector_invoke_element_callback then frees the backing storage at [this+0x14] and finally releases the vector object itself through tracked_heap_free_with_header.	rizin + llvm-objdump
397	0x0059e370	87	generic_vector_insert_copy_at	support	cdecl	inferred	rizin	4	Ensures capacity grows through 0x0059e090 when full increments the count shifts the tail upward when inserting before the end and copies the caller element record into the requested slot through generic_vector_store_at.	rizin + llvm-objdump
398	0x0059e3d0	22	generic_vector_erase_with_callback	support	cdecl	inferred	rizin	4	Calls generic_vector_invoke_element_callback for the indexed slot and then removes that slot through generic_vector_erase. Current grounded callers use it for registered-name and callback-entry teardown paths.	rizin + llvm-objdump
399	0x0059e3f0	33	generic_vector_overwrite_with_callback	support	cdecl	inferred	rizin	4	Invokes generic_vector_invoke_element_callback for one indexed slot and then copies the caller replacement record back into that same slot through generic_vector_store_at. Hashed entry-table upsert uses it when replacing an existing matching record.	rizin + llvm-objdump
400	0x0059e420	137	generic_vector_find_index	support	cdecl	inferred	rizin	4	Returns the index of one matching element within the contiguous vector or `-1` when none is found. Depending on the caller flag it uses either the linear comparator scan at 0x0059e240 or the ordered search helper at 0x0059e290 and derives the final index from the matched element pointer and stride.	rizin + llvm-objdump
401	0x0059d7f0	86	multiplayer_transport_collect_registered_name_callback_entries	shell	cdecl	inferred	ghidra-headless	3	Callback collector used by the registered-name fast path. For each callback entry in the name entry's callback list it grows two parallel pointer arrays in the caller scratch frame through tracked_heap_resize_with_header and appends the callback entry pointer plus its `[entry+0xdc]` payload pointer. Current grounded caller is multiplayer_transport_dispatch_registered_name_query_fastpath through generic_callback_list_for_each.	ghidra + rizin + llvm-objdump
402	0x0059d850	114	multiplayer_transport_dispatch_registered_name_query_fastpath	shell	cdecl	inferred	ghidra-headless	3	Fast path for multiplayer_transport_submit_names_query_with_callback when the queried sample already exists in the registered-name table. It resolves the name entry through multiplayer_transport_lookup_registered_name collects entry-owned callback state through multiplayer_transport_collect_registered_name_callback_entries and invokes the caller callback through multiplayer_transport_invoke_registered_name_query_callback without enqueueing a transport names-query record. Temporary callback arrays are released through tracked_heap_free_with_header on exit.	ghidra + rizin + llvm-objdump
403	0x0059d8d0	15	multiplayer_transport_has_registered_name	shell	cdecl	inferred	ghidra-headless	3	Boolean wrapper over multiplayer_transport_lookup_registered_name. It returns true when the caller string resolves to one registered-name entry in the transport-side table and false otherwise. Current grounded caller is multiplayer_transport_submit_names_query_with_callback.	ghidra + rizin + llvm-objdump
404	0x0059d8e0	64	multiplayer_transport_try_read_registered_name_header_block	shell	cdecl	inferred	rizin	4	Looks up one registered-name entry and when the header-valid flag at `[entry+0x154]` is set copies the 7-dword header block at `[entry+0x138]` into the caller buffer and returns true. Otherwise it returns false without mutating the destination.	rizin + llvm-objdump
405	0x0059d920	48	multiplayer_transport_set_registered_name_header_block	shell	cdecl	inferred	rizin	4	Looks up one registered-name entry copies 7 caller-supplied dwords into the header block at `[entry+0x138]` and sets the paired valid flag at `[entry+0x154]` to one.	rizin + llvm-objdump
406	0x0059d950	112	multiplayer_transport_set_registered_name_status_text	shell	cdecl	inferred	rizin	3	Looks up one registered-name entry frees the prior heap string at `[entry+0x158]` and replaces it with a heap copy of the caller text or the shared empty string when the caller passes null. The helper currently looks like the main per-name status or topic text setter for the registered-name store.	rizin + llvm-objdump
407	0x0059d9c0	32	multiplayer_transport_mark_registered_name_dirty	shell	cdecl	inferred	rizin	3	Looks up one registered-name entry and sets the dword dirty or active flag at `[entry+0x15c]` to one.	rizin + llvm-objdump
408	0x0059d9e0	32	multiplayer_transport_get_registered_name_dirty	shell	cdecl	inferred	rizin	3	Looks up one registered-name entry and returns the current dword dirty or active flag stored at `[entry+0x15c]` or zero when the entry is absent.	rizin + llvm-objdump
409	0x0059da00	64	multiplayer_transport_set_registered_name_display_text	shell	cdecl	inferred	rizin	3	Looks up one registered-name entry copies up to 0x80 bytes of caller text into the embedded buffer at `[entry+0x160]` through string_copy_bounded_zerofill and clears the trailing byte flag at `[entry+0x1df]`. This is a second inline text field distinct from the heap string at `[entry+0x158]`.	rizin + llvm-objdump
410	0x0059da40	208	multiplayer_transport_upsert_registered_name_callback_entry	shell	cdecl	inferred	rizin	4	Looks up one registered-name entry zeroes a temporary 0xe0-byte nested callback-entry record copies the secondary key string into the local record and when both payload blocks are provided copies 0x18 bytes into `[record+0x80]` and 0x40 bytes into `[record+0x98]` sets the local active flag at `[record+0xd8]` and stores one caller dword at `[record+0xdc]` before upserting the record into the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_upsert.	rizin + llvm-objdump
411	0x0059db10	80	multiplayer_transport_remove_registered_name_callback_entry	shell	cdecl	inferred	rizin	4	Looks up one registered-name entry copies the caller secondary key into a stack-local temporary and removes the matching nested callback-entry record from the entry-owned callback table at `[entry+0x134]` through hashed_entry_table_remove.	rizin + llvm-objdump
412	0x0059db90	96	multiplayer_transport_dispatch_registered_name_callback_entry	shell	cdecl	inferred	rizin	3	Fans one callback descriptor over the transport-side registered-name store. It copies the primary name into a stack-local key builds a small dispatch frame and visits all registered-name entries through generic_callback_list_for_each where helper 0x0059db60 resolves the matching nested callback-entry record and invokes the descriptor function pointer at `[desc+0x08]` with the descriptor owner context plus the secondary key plus the payload cookie plus the owning registered-name entry.	rizin + llvm-objdump
413	0x0059dcb0	48	multiplayer_transport_update_registered_name_callback_key	shell	cdecl	inferred	rizin	3	Visits every registered-name entry through generic_callback_list_for_each and runs helper 0x0059dbf0 to rewrite one nested callback-entry key. The helper removes the existing nested record from `[entry+0x134]` copies the replacement key into the local record reinserts it through hashed_entry_table_upsert and conditionally emits transport opcode 8 through 0x0059b790 when the name entry is marked dirty and has owner callbacks installed.	rizin + llvm-objdump
414	0x0059dce0	256	multiplayer_transport_update_registered_name_callback_flags	shell	cdecl	inferred	rizin	4	Looks up one registered-name entry then resolves one nested callback-entry record by secondary key from the entry-owned callback table at `[entry+0x134]`. Depending on the caller mode flag it ORs or clears the caller bitmask against `[subentry+0xdc]` and when the parent entry has transport callbacks installed publishes an opcode-11 update through 0x0059b790 carrying the primary name plus the secondary key plus the new flag mask.	rizin + llvm-objdump
415	0x0059de00	64	multiplayer_transport_dispatch_registered_name_callbacks	shell	cdecl	inferred	rizin	3	If the owning transport is active at `[*this]` it walks the full registered-name store through generic_callback_list_for_each and helper 0x0059dde0 increments a dispatch count and invokes the caller-provided callback function for each live registered-name entry.	rizin + llvm-objdump
416	0x0059de40	96	multiplayer_transport_stage_registered_name_callback_payload	shell	cdecl	inferred	rizin	3	Resolves one nested callback-entry record by secondary key from the caller registered-name entry then copies a 0x18-byte payload block into `[subentry+0x80]` and a 0x40-byte payload block into `[subentry+0x98]` null-terminates both copied regions and sets the active flag at `[subentry+0xd8]` to one.	rizin + llvm-objdump
417	0x0059dea0	96	multiplayer_transport_stage_registered_name_callback_payload_for_name	shell	cdecl	inferred	rizin	3	Looks up one primary registered-name entry then fans helper multiplayer_transport_stage_registered_name_callback_payload across the registered-name store through generic_callback_list_for_each using the caller secondary key plus the two payload buffers. Current grounded role is a primary-name keyed payload staging wrapper for nested callback-entry records.	rizin + llvm-objdump
418	0x0059df00	96	multiplayer_transport_try_resolve_registered_name_callback_payload	shell	cdecl	inferred	rizin	4	Fast resolver for one nested callback-entry payload. When the descriptor either has no selector string or matches the shared two-byte default token at 0x005e1e1c it looks up the nested callback-entry record by key from `[entry+0x134]` and if the entry is active at `[subentry+0xd8]` marks the descriptor successful and returns pointers to the staged payload blocks at `[subentry+0x80]` and `[subentry+0x98]`.	rizin + llvm-objdump
419	0x005934c0	30	multiplayer_transport_next_work_sequence	shell	thiscall	inferred	ghidra-headless	3	Returns the next monotonically increasing transport work-sequence value by incrementing dword [this+0x177c] and clamping negative wraparound back to zero. Current grounded callers use the returned value when allocating transient transport records for text submission registration and related async work.	ghidra + rizin + llvm-objdump
420	0x00593650	229	multiplayer_transport_attach_callback_table_descriptor	shell	cdecl	inferred	ghidra-headless	3	Builds one transport-side callback-table descriptor from the caller table pointers and metadata. The helper allocates a temporary registration object through 0x005934e0 installs callback vectors from the 0x0059f5c0 and 0x0059f650 tables copies the caller transport pointer into the local stack frame and finishes by linking the result through 0x0058f2f0 and 0x005933a0. The current grounded caller is multiplayer_transport_register_callback_table.	ghidra + rizin + llvm-objdump
421	0x00593d60	66	multiplayer_transport_try_submit_text_record_fastpath	shell	cdecl	inferred	ghidra-headless	3	Attempts the fast submission path for one prepared transport text record. It allocates a type-9 transient record through 0x005934e0 and when that succeeds forwards the caller callback and payload through 0x0058e510 with callback shim 0x00593d00. The current grounded caller is multiplayer_transport_submit_text_record.	ghidra + rizin + llvm-objdump
422	0x00598d50	496	multiplayer_transport_handle_registered_name_callback_bind_record_mode1	shell	cdecl	inferred	rizin	3	Owner-side wrapper for record mode 1 in the registered-name branch. It parses the mode prefix from the secondary key string at record field `+0x08` checks whether the primary name matches the local transport name at `[this+0x36c]` and either seeds one local registered-name entry through multiplayer_transport_upsert_registered_name_entry plus multiplayer_transport_set_registered_name_status_text or upserts one nested callback-entry record through multiplayer_transport_upsert_registered_name_callback_entry and emits follow-up opcode 6 or opcode 12 notifications when the target name entry is already marked dirty.	rizin + llvm-objdump
423	0x00598f40	255	multiplayer_transport_handle_registered_name_callback_remove_record_mode1	shell	cdecl	inferred	rizin	3	Owner-side removal wrapper for registered-name record mode 1. It resolves the primary and secondary key strings from the caller record removes the matching nested callback-entry through multiplayer_transport_remove_registered_name_callback_entry and then emits opcode 7 or opcode 12 notifications from the current registered-name owner callbacks when the target entry is dirty.	rizin + llvm-objdump
424	0x00599040	308	multiplayer_transport_handle_registered_name_callback_remove_record_mode23	shell	cdecl	inferred	rizin	3	Owner-side removal wrapper for registered-name record modes 2 and 3. It removes one nested callback-entry record by secondary key and then branches on whether the primary name matches the local transport name. The local-owner branch can emit opcode 5 and remove the whole registered-name entry through multiplayer_transport_remove_registered_name_entry while the remote branch emits opcode 7 subtype notifications through the installed owner callbacks.	rizin + llvm-objdump
425	0x00599180	160	multiplayer_transport_publish_registered_name_callback_remove_mode1	shell	cdecl	inferred	rizin	3	Small publish helper for registered-name callback-removal mode 1. It removes the named nested callback-entry and then emits the same owner callback notifications as the wider mode-1 removal path through opcode 7 and opcode 12 when the target entry is dirty and callback-enabled.	rizin + llvm-objdump
426	0x00599230	25	multiplayer_transport_dispatch_registered_name_callback_remove_mode1	shell	cdecl	inferred	rizin	3	Dispatch shim for registered-name callback-removal mode 1. When the input record kind equals 1 it forwards the primary name and one mode-1 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry so the removal helper runs against each matching registered-name entry.	rizin + llvm-objdump
427	0x00599250	160	multiplayer_transport_publish_registered_name_callback_remove_mode3	shell	cdecl	inferred	rizin	3	Small publish helper for registered-name callback-removal mode 3. It removes the named nested callback-entry and emits the mode-3 owner callback notifications through opcode 7 and opcode 12 when the target registered-name entry is dirty and callback-enabled.	rizin + llvm-objdump
428	0x00599300	25	multiplayer_transport_dispatch_registered_name_callback_remove_mode3	shell	cdecl	inferred	rizin	3	Dispatch shim for registered-name callback-removal mode 3. When the input record kind equals 2 it forwards the primary name and one mode-3 removal helper descriptor into multiplayer_transport_dispatch_registered_name_callback_entry.	rizin + llvm-objdump
429	0x00599320	93	multiplayer_transport_handle_registered_name_display_text_record_mode2	shell	cdecl	inferred	rizin	4	Owner-side wrapper for registered-name display-text record mode 2. It copies the record string into the inline display buffer through multiplayer_transport_set_registered_name_display_text and when the target registered-name entry has an installed owner callback emits opcode 9 carrying the primary name and copied display text.	rizin + llvm-objdump
430	0x00599380	253	multiplayer_transport_apply_registered_name_update_bundle	shell	cdecl	inferred	rizin	4	Applies one parsed update bundle to an existing registered-name entry. It walks the decoded element list from 0x00598630 and uses the element tags to route updates into multiplayer_transport_update_registered_name_callback_flags multiplayer_transport_set_registered_name_status_text and the header read or write pair multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block before releasing the decoded bundle object.	rizin + llvm-objdump
431	0x005997f0	177	multiplayer_transport_handle_registered_name_display_text_record_mode3	shell	cdecl	inferred	rizin	3	Owner-side wrapper for registered-name display-text record mode 3. It stores the supplied display text into the inline registered-name buffer and either resolves one pending template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 9 through the installed owner callback for the target registered-name entry.	rizin + llvm-objdump
432	0x005998b0	171	multiplayer_transport_handle_registered_name_display_text_clear_record	shell	cdecl	inferred	rizin	3	Owner-side wrapper for clearing registered-name display text. It builds a small mode-2 template with the shared empty string and either satisfies that request through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node or emits opcode 9 with the empty display text through the installed owner callback for the target registered-name entry.	rizin + llvm-objdump
433	0x00599960	144	multiplayer_transport_handle_pending_template_pair_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Structural mode-3 wrapper over the pending-template path. It builds one single-entry pending-template query from the pair of caller strings then resolves a matching node through multiplayer_transport_find_pending_template_node and dispatches it through multiplayer_transport_dispatch_pending_template_node. When no pending node exists it falls back to the transport-side callback at `[this+0x04]` through multiplayer_transport_dispatch_or_release_callback_binding.	llvm-objdump
434	0x005999f0	412	multiplayer_transport_handle_registered_name_callback_payload_record_mode8	shell	cdecl	inferred	rizin	3	Owner-side wrapper for registered-name record mode 8. It stages the supplied nested callback-entry payload blocks through multiplayer_transport_stage_registered_name_callback_payload_for_name and then walks the returned template nodes to emit higher-level follow-up notifications including opcode 0x16 and opcode 0x17 based on the decoded template kinds and the marker characters found in the staged payload text through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.	rizin + llvm-objdump
435	0x00599c40	96	multiplayer_transport_copy_backslash_segment	shell	cdecl	inferred	llvm-objdump	4	Copies one backslash-delimited segment from the caller text into a freshly allocated heap string and writes the consumed byte count back through the out-parameter. Higher-level pending-template handlers reuse it to split multi-segment payloads before dispatch or callback fallback.	llvm-objdump
436	0x00599ca0	320	multiplayer_transport_handle_segment_list_template_record_mode4	shell	cdecl	inferred	llvm-objdump	3	Mode-4 pending-template wrapper for template kind 0x0c. It resolves one pending node through multiplayer_transport_find_pending_template_node splits the caller payload into a temporary heap string list with multiplayer_transport_copy_backslash_segment and then either dispatches that list through multiplayer_transport_dispatch_pending_template_node or falls back to emitting opcode 0x1e through the node-owned callback path before freeing the temporary segments.	llvm-objdump
437	0x00599de0	128	multiplayer_transport_handle_pair_template_record_mode4	shell	cdecl	inferred	llvm-objdump	3	Compact mode-4 pending-template wrapper for template kind 0x0c. After multiplayer_transport_find_pending_template_node succeeds it forwards two dword values from the matched node-owned payload block into one simple dispatch descriptor and completes the request through multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
438	0x00599e60	768	multiplayer_transport_handle_segment_broadcast_template_record_mode5	shell	cdecl	inferred	llvm-objdump	3	Structural mode-5 pending-template wrapper over split payload broadcasting. One branch matches a fixed token and walks the registered-name owner callback list to emit opcode 0x1d once per backslash-delimited segment. The other branch resolves one template-kind 0x0d pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment optionally appends node-owned paired strings and then either dispatches the finished descriptor through multiplayer_transport_dispatch_pending_template_node or falls back to opcode 0x1f through the node callback path.	llvm-objdump
439	0x0059a160	128	multiplayer_transport_handle_triplet_template_record_mode4	shell	cdecl	inferred	llvm-objdump	3	Compact mode-4 pending-template wrapper for template kind 0x0d. After multiplayer_transport_find_pending_template_node succeeds it forwards the caller primary string plus two dword fields from the matched node payload block through multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
440	0x0059a1e0	1024	multiplayer_transport_handle_segment_pair_template_record_mode4	shell	cdecl	inferred	llvm-objdump	3	Structural mode-4 sibling of the split-payload template path for template kind 0x0e. One branch matches the fixed auxiliary token and emits opcode 0x1d once per backslash-delimited segment through the installed registered-name owner callbacks. The other branch resolves one pending node builds a temporary split-string array with multiplayer_transport_copy_backslash_segment appends paired node-owned strings and completes the request through multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
441	0x0059a650	64	multiplayer_transport_mark_pending_template_kind1_ready	shell	cdecl	inferred	llvm-objdump	3	Small pending-template helper that looks up one kind-1 node through multiplayer_transport_find_pending_template_node and sets the first dword in its payload block to one when present.	llvm-objdump
442	0x0059a690	448	multiplayer_transport_stage_pending_template_triplet_record_mode4	shell	cdecl	inferred	llvm-objdump	3	Mode-4 helper for pending-template kind 1. It resolves one kind-1 node through multiplayer_transport_find_pending_template_node duplicates the caller strings plus one normalized helper string into heap storage emits opcode 0x0e through 0x0059b790 using the node-owned callback metadata and appends the three staged values into the node payload's parallel pointer arrays for later dispatch.	llvm-objdump
443	0x0059a850	112	multiplayer_transport_dispatch_pending_template_quintuple_helper	shell	cdecl	inferred	llvm-objdump	3	Small helper that resolves one kind-5 pending-template node through multiplayer_transport_find_pending_template_node and forwards the four dword payload fields stored at `[node+0x1c+0x04..0x10]` through multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
444	0x0059a8c0	272	multiplayer_transport_handle_registered_name_update_bundle_record_mode3plus	shell	cdecl	inferred	llvm-objdump	3	Owner-side registered-name update handler for record kinds 3 and above. It decodes one update bundle through 0x00598630 and 0x00598860 tries the registered-name header read or write path through multiplayer_transport_try_read_registered_name_header_block plus multiplayer_transport_set_registered_name_header_block publishes opcode 0x0a when the target entry already has owner callbacks and then completes any waiting kind-5 pending-template node through multiplayer_transport_find_pending_template_node plus multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
445	0x0059a9d0	320	multiplayer_transport_handle_pending_template_triplet_record_mode6	shell	cdecl	inferred	llvm-objdump	3	Mode-6 pending-template wrapper that looks up either a kind-4 or kind-7 node through multiplayer_transport_find_pending_template_node. The kind-4 branch copies three caller strings into the node-owned payload slots while the kind-7 branch formats a derived string through 0x0059cbd0 and completes the request through multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
446	0x0059ab10	256	multiplayer_transport_handle_token_list_template_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Mode-3 pending-template helper for kind 4. It parses the caller text into a token list with 0x005a3db9 trims leading `-` `@` and `+` markers duplicates each token into heap storage and appends the cleaned strings into the node-owned dynamic vector after multiplayer_transport_find_pending_template_node succeeds.	llvm-objdump
447	0x0059ac10	144	multiplayer_transport_dispatch_extended_template_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Mode-3 helper for kind-4 pending-template nodes. After multiplayer_transport_find_pending_template_node succeeds it builds one extended dispatch descriptor from the caller string a boolean derived from the first payload dword and the remaining four dwords stored in the node payload block then completes the request through multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
448	0x0059aca0	176	multiplayer_transport_append_string_template_record_mode8	shell	cdecl	inferred	llvm-objdump	3	Helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node grows the node-owned pointer vector through tracked_heap_resize_with_header duplicates the caller string and appends that heap string to the vector.	llvm-objdump
449	0x0059ad50	112	multiplayer_transport_dispatch_string_vector_template_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Mode-3 dispatch helper for pending-template kind 8. It resolves one node through multiplayer_transport_find_pending_template_node then forwards the caller key together with the node-owned string-count and string-vector pointers through multiplayer_transport_dispatch_pending_template_node.	llvm-objdump
450	0x0059adc0	96	multiplayer_transport_handle_local_name_record_mode2	shell	cdecl	inferred	llvm-objdump	4	Mode-2 transport-state setter for the local name buffer at `[this+0x36c]`. It copies the caller string into that fixed buffer clears state dword `[this+0x04]` sets active flag `[this+0x00]` and when the transport owner callback at `[this+0x14]` is installed invokes it with mode `1` and the owner cookie at `[this+0x18]`.	llvm-objdump
451	0x0059ae20	176	multiplayer_transport_handle_transport_text_pair_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Mode-3 transport-state setter for a pair of fixed text buffers. It copies the caller strings into the fixed buffers at `[this+0x564]` and `[this+0x140]` updates the associated length or dirty fields through helpers 0x005a1050 and 0x005a0d00 marks `[this+0x13c]` active and refreshes the transport-side status line rooted at `[this+0x1c]` through 0x0059caf0.	llvm-objdump
452	0x0059aed0	112	multiplayer_transport_handle_normalized_pair_template_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Mode-3 wrapper that normalizes the secondary caller string through 0x005a1ea5 then resolves one kind-0x10 pending-template node through multiplayer_transport_find_pending_template_node and completes it through multiplayer_transport_dispatch_pending_template_node with the normalized value plus the original secondary string.	llvm-objdump
453	0x00597920	56	multiplayer_transport_find_pending_template_kind0c_by_key	shell	cdecl	inferred	llvm-objdump	4	Searches the linked pending-template list rooted at `[this+0x550]` for the first kind-0x0c node whose payload string at `[node+0x1c+0x08]` exactly matches the caller key. It returns the matched node or null.	llvm-objdump
454	0x0059af40	186	multiplayer_transport_dispatch_fallback_template_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Mode-3 fallback wrapper over the pending-template path. It first queries for either a kind-1 or kind-5 node keyed by the caller string through multiplayer_transport_find_pending_template_node and dispatches the matching node through multiplayer_transport_dispatch_pending_template_node with a minimal descriptor. When neither node exists it falls back to multiplayer_transport_find_pending_template_kind0c_by_key and completes that node with an empty descriptor instead.	llvm-objdump
455	0x0059b000	103	multiplayer_transport_dispatch_kind1_string_template_record_mode6	shell	cdecl	inferred	llvm-objdump	3	Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `6` and the original string payload.	llvm-objdump
456	0x0059b070	103	multiplayer_transport_dispatch_kind1_string_template_record_mode2	shell	cdecl	inferred	llvm-objdump	3	Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `2` and the original string payload.	llvm-objdump
457	0x0059b0e0	103	multiplayer_transport_dispatch_kind1_string_template_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `3` and the original string payload.	llvm-objdump
458	0x0059b150	103	multiplayer_transport_dispatch_kind1_string_template_record_mode4	shell	cdecl	inferred	llvm-objdump	3	Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `4` and the original string payload.	llvm-objdump
459	0x0059b1c0	103	multiplayer_transport_dispatch_kind1_string_template_record_mode5	shell	cdecl	inferred	llvm-objdump	3	Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `5` and the original string payload.	llvm-objdump
460	0x0059b230	103	multiplayer_transport_dispatch_kind1_string_template_record_mode8	shell	cdecl	inferred	llvm-objdump	3	Fixed-mode wrapper for kind-1 pending-template nodes. It resolves the caller string through multiplayer_transport_find_pending_template_node and completes the matched node through multiplayer_transport_dispatch_pending_template_node with dispatch mode `8` and the original string payload.	llvm-objdump
461	0x0059b2a0	1	multiplayer_transport_noop_cleanup_callback	shell	cdecl	inferred	llvm-objdump	2	Trivial no-op cleanup callback that returns immediately. Current grounded role is as a placeholder callback target in the transport cleanup layer.	llvm-objdump
462	0x0059b2b0	17	multiplayer_transport_release_optional_callback_binding	shell	cdecl	inferred	llvm-objdump	2	Small cleanup helper that checks the optional callback binding stored at `[this+0x04]` and when present forwards it into multiplayer_transport_dispatch_or_release_callback_binding with mode `1`.	llvm-objdump
463	0x0059b2d0	8	multiplayer_transport_free_template_entry_owner_string	shell	cdecl	inferred	llvm-objdump	3	Small element cleanup helper that releases the owner string pointer stored at `[entry+0x14]` through tracked_heap_free_with_header. The companion pending-template container uses it as the per-element cleanup callback when destroying its flat vector.	llvm-objdump
464	0x0059b2e0	1239	multiplayer_transport_destroy_pending_template_dispatch_record	shell	cdecl	inferred	llvm-objdump	3	Type-switched destructor for one pending-template dispatch record. It reads the record kind at `[record+0x00]` and frees the owned payload graph under `[record+0x08]` through tracked_heap_free_with_header including nested string arrays and paired pointer vectors for the more complex template kinds before finally releasing the top-level payload block itself.	llvm-objdump
465	0x0059b710	40	multiplayer_transport_init_pending_template_dispatch_store	shell	thiscall	inferred	llvm-objdump	3	Initializes the companion flat pending-template dispatch store at `[this+0x55c]` by allocating a stride-0x18 contiguous vector through 0x0059e0b0 and installing multiplayer_transport_free_template_entry_owner_string as the per-element cleanup callback. Returns true on success.	llvm-objdump
466	0x0059b740	74	multiplayer_transport_destroy_pending_template_dispatch_store	shell	thiscall	inferred	llvm-objdump	3	Destroys the companion flat pending-template dispatch store at `[this+0x55c]`. It walks every live element through multiplayer_transport_destroy_pending_template_dispatch_record and then releases the backing vector through generic_vector_destroy.	llvm-objdump
467	0x0059c220	458	multiplayer_transport_dispatch_pending_template_dispatch_record	shell	unknown	inferred	rizin	3	Switch-driven dispatcher for one flat pending-template dispatch-store record after the store manager has removed it from the vector. It reads the record kind at `[record+0x00]` invokes the record-owned callback at `[record+0x04]` with a payload tuple rooted at `[record+0x08]` and the owner string or selector at `[record+0x0c]` and then destroys the record through multiplayer_transport_destroy_pending_template_dispatch_record. Case `16` also resolves the registered-name dirty flag through 0x0059d9c0 before invoking the callback.	rizin + llvm-objdump
468	0x0059c470	203	multiplayer_transport_service_pending_template_dispatch_store	shell	unknown	inferred	rizin	3	Services the flat pending-template dispatch store at `[this+0x55c]`. It walks every live 0x18-byte entry; entries whose owner string at `[entry+0x14]` no longer resolves through multiplayer_transport_has_registered_name are destroyed and erased immediately, while surviving entries are dispatched only when their registered-name dirty flag is nonzero and the optional filter value in EDX is zero or matches `[entry+0x10]`. Dispatching copies the 0x18-byte record to stack storage, erases the vector slot, and forwards the copied record into multiplayer_transport_dispatch_pending_template_dispatch_record.	rizin + llvm-objdump
469	0x0059c540	70	multiplayer_transport_find_pending_template_dispatch_record_index	shell	unknown	inferred	rizin	4	Searches the flat pending-template dispatch store at `[this+0x55c]` for the first record whose selector or request field at `[entry+0x10]` matches the caller key. It returns the zero-based vector index on success or `-1` when no record matches.	rizin + llvm-objdump
470	0x0059c590	21	multiplayer_transport_has_pending_template_dispatch_record	shell	unknown	inferred	rizin	4	Boolean wrapper over multiplayer_transport_find_pending_template_dispatch_record_index. It returns true when the flat pending-template dispatch store currently contains one record for the caller key and false otherwise.	rizin + llvm-objdump
471	0x0059c5b0	40	growable_text_buffer_init	support	unknown	inferred	rizin	3	Initializes one heap-backed growable text buffer structure. It clears the used-length field at `[buf+0x04]`, seeds the initial capacity at `[buf+0x08]` to `0x2000`, allocates a `0x2001`-byte NUL-terminated backing block through tracked_heap_alloc_with_header, stores that pointer at `[buf+0x00]`, and returns true on success.	rizin + llvm-objdump
472	0x0059c5e0	3	growable_text_buffer_free	support	unknown	inferred	rizin	4	Small wrapper that frees the heap-backed buffer pointer stored at `[buf+0x00]` through tracked_heap_free_with_header.	rizin + llvm-objdump
473	0x0059c5f0	65	growable_text_buffer_reserve_append	support	unknown	inferred	rizin	4	Ensures that one growable text buffer has room to append the requested byte count in ECX while preserving a trailing NUL terminator. When `[buf+0x04] + requested` would exceed capacity `[buf+0x08]` it rounds the new capacity up in 0x2000-byte chunks resizes the backing block through tracked_heap_resize_with_header stores the new pointer at `[buf+0x00]` and updates `[buf+0x08]` before returning success or failure.	rizin + llvm-objdump
474	0x0059c670	76	multiplayer_transport_text_stream_init	shell	thiscall	inferred	rizin	3	Initializes one multiplayer transport text-stream object. It zeroes the 0x350-byte state block seeds socket `[this+0x00]` to `-1` and allocates two growable text buffers at `[this+0x108]` and `[this+0x114]` through growable_text_buffer_init. Failure to allocate the second buffer frees the first and returns false.	rizin + llvm-objdump
475	0x0059c790	194	multiplayer_transport_text_stream_destroy	shell	thiscall	inferred	rizin	4	Destroys one multiplayer transport text-stream object. If socket `[this+0x00]` is live it shuts it down with `shutdown(..., 2)` and `closesocket`, marks state `[this+0x04]` as closed, frees the two growable text buffers at `[this+0x108]` and `[this+0x114]`, releases the fixed pointer fields at `[this+0x328]` through `[this+0x344]`, then walks and frees the pointer vector rooted at `[this+0x348]` before freeing that vector itself.	rizin + llvm-objdump
476	0x0059c860	300	multiplayer_transport_select_socket_ready_flags	shell	cdecl	inferred	rizin	4	Small `select` wrapper for one transport socket. It takes the socket on the stack plus up to three optional out-pointers for read write and exception readiness, builds the requested `fd_set` structures on the stack, calls `select(0x40, ...)` with a null timeout, and stores `1` or `0` into each requested out-slot depending on whether `__WSAFDIsSet` reports that socket as ready.	rizin + llvm-objdump
477	0x0059c990	113	multiplayer_transport_text_stream_send_pump	shell	thiscall	inferred	rizin	4	Attempts to flush queued bytes from the transport text-stream send buffer at `[this+0x114]`. While buffered length `[this+0x118]` remains nonzero it probes writability through multiplayer_transport_select_socket_ready_flags, sends up to `min(len, 0x400)` bytes with `send`, slides any remaining buffered bytes down through `0x0059c640`, and continues until the socket is no longer writable or the buffer is empty.	rizin + llvm-objdump
478	0x0059ca10	190	multiplayer_transport_text_stream_recv_pump	shell	thiscall	inferred	rizin	3	Receives available socket text into the transport text-stream receive buffer at `[this+0x108]`. It first probes readability through multiplayer_transport_select_socket_ready_flags then repeatedly reserves 0x1000 bytes through growable_text_buffer_reserve_append calls `recv` into the free tail of the buffer optionally applies the stream-cipher helper at 0x005a0f70 when `[this+0x120]` is armed advances the used-length field at `[this+0x10c]` NUL-terminates the buffer and loops while readability remains set. Socket errors store closed-state value `2` into `[this+0x04]`.	rizin + llvm-objdump
479	0x0059cad0	25	multiplayer_transport_text_stream_service_io	shell	thiscall	inferred	rizin	4	Services one multiplayer transport text-stream I/O step unless state `[this+0x04]` is already closed. It first flushes queued outbound bytes through multiplayer_transport_text_stream_send_pump and then pumps inbound socket text through multiplayer_transport_text_stream_recv_pump.	rizin + llvm-objdump
480	0x0059caf0	216	multiplayer_transport_text_stream_append_crlf_line	shell	thiscall	inferred	rizin	4	Appends one caller text line plus `\\r\\n` to the transport text-stream send buffer at `[this+0x114]`. It ignores requests when state `[this+0x04]` is already closed, reserves `strlen(text) + 2` bytes through growable_text_buffer_reserve_append, copies the bytes into the current tail tracked by `[this+0x118]`, appends CRLF, and updates the used-length field. When the stream-cipher gate at `[this+0x120]` is armed it post-processes the newly appended span through 0x005a0f70 using the send-side cipher state rooted at `[this+0x226]`.	rizin + llvm-objdump
481	0x00597880	159	multiplayer_transport_find_pending_template_node	shell	cdecl	inferred	rizin	4	Searches the linked pending-template list rooted at `[this+0x550]` for the first node whose caller-provided query tuple array matches the node kind and its primary and secondary string selectors. When it finds a match it refreshes the node timeout field at `[node+0x04]` from GetTickCount plus 0xea60 and returns that node pointer otherwise it returns null.	rizin + llvm-objdump
482	0x005979d0	1164	multiplayer_transport_dispatch_pending_template_node	shell	cdecl	inferred	rizin	3	Consumes one pending-template node and one caller dispatch descriptor. Depending on the node kind it emits one or more transport notifications through 0x0059b790 using the node-owned strings arrays and callback state then releases the node-owned heap strings arrays and child lists before unlinking the node from the pending-template list. Higher-level registered-name wrappers reuse it as the common completion path after multiplayer_transport_find_pending_template_node succeeds.	rizin + llvm-objdump
483	0x005996c0	304	multiplayer_transport_handle_pending_template_record_mode3	shell	cdecl	inferred	llvm-objdump	3	Structural mode-3 wrapper over the pending-template path for registered-name updates. It normalizes the caller selector string against the shared default token at 0x005e1e1c builds a four-way pending-template query and dispatches the matched node through multiplayer_transport_dispatch_pending_template_node. Depending on the matched node kind it can mark the registered-name entry dirty through multiplayer_transport_mark_registered_name_dirty or forward the node-owned payload fields into the dispatch descriptor.	llvm-objdump
484	0x00565c90	208	shell_queue_indexed_world_anchor_marker	shell	cdecl	inferred	ghidra-headless	3	Variant world-anchor marker emitter that selects one indexed entry from the owner table at +0x24 using byte [this+0xd8] derives scale and packed color from the entry fields and enqueues the resulting type-0x01 deferred message through shell_enqueue_deferred_message_type1.	ghidra + rizin + llvm-objdump
485	0x005662a0	964	shell_emit_sprite_billboard_quad_vertex24	bootstrap	thiscall	inferred	ghidra-headless	4	Expands one sprite billboard into six vertex24 records forming two textured triangles. It derives an alpha byte from item timing flags at [this+0x48] [this+0x4c] and [this+0x5c] combines that alpha with packed color [this+0x70] scales a prepared four-corner basis by [this+0x44] and writes six 24-byte vertices using atlas uv pairs from [this+0x2c..0x38].	ghidra + rizin + llvm-objdump
486	0x00566670	84	shell_prepare_sprite_billboard_basis	bootstrap	thiscall	inferred	ghidra-headless	3	Builds the temporary four-corner sprite-billboard basis used by 0x005662a0 from the current shell transform state and writes the result into global scratch vectors around 0x00d97ae0 and 0x00d97b98.	ghidra + rizin + llvm-objdump
487	0x0055e2b0	179	shell_create_layout_state	bootstrap	thiscall	inferred	ghidra-headless	4	Allocates a 0x3715-byte layout-state object for the shell controller stores it at [this+0x2d] seeds the dirty flags invokes 0x0054bc10 with owner state and a template byte from the shell bundle then binds the first presentation asset bundle through 0x00543f10 before later update hooks run.	ghidra + rizin
488	0x005679b0	569	shell_emit_animated_quad_vertex24	bootstrap	thiscall	inferred	ghidra-headless	4	Expands one cell-list item into four `vertex24` corner records with a time-varying color phase. The helper derives an 8-step brightness cycle from GetTickCount plus item field [this+0x3a] combines that phase with per-corner bytes at +0x35 through +0x38 and mask bytes at +0x31 through +0x34 and writes four 24-byte vertices from the quad corner positions stored across +0x00..+0x2c.	ghidra + rizin + llvm-objdump
489	0x00567c70	103	shell_stream_primary_cell_quad_list	bootstrap	thiscall	inferred	ghidra-headless	4	Streams the primary quad-item list rooted at [this+0x1c] into the caller's `vertex24` buffer. It seeds the shared color input through 0x00d97bbc iterates each list entry through 0x005679b0 and advances the destination pointer by count*0x90 for four vertices per item.	ghidra + rizin + llvm-objdump
490	0x00567ce0	105	shell_stream_alternate_cell_quad_list	bootstrap	thiscall	inferred	ghidra-headless	4	Streams the alternate quad-item list rooted at [this+0x20] into the caller's `vertex24` buffer using the same quad writer at 0x005679b0. Unlike the primary path it forwards an extra caller-supplied selector value into each emitted quad before advancing the destination pointer by count*0x90.	ghidra + rizin + llvm-objdump
491	0x005a644d	81	__heap_init	startup	cdecl	inferred	ghidra-headless	4	Initializes the CRT heap path via ___heap_select and ___sbh_heap_init before later allocations occur.	ghidra + rizin
492	0x005abd49	111	startup_init_tls_state	startup	unknown	inferred	ghidra-headless	3	Initializes per-thread startup state: mt locks plus TLS slot allocation and current-thread bookkeeping.	ghidra + rizin
493	0x005abf1b	510	startup_init_file_handle_table	startup	cdecl	inferred	ghidra-headless	4	Allocates and seeds the CRT file descriptor table then consumes STARTUPINFO handles and classifies inherited std handles.	ghidra + rizin
494	0x005aca5d	61	startup_run_init_callback_table	startup	unknown	inferred	ghidra-headless	3	Walks a startup callback table and invokes non-null entries before continuing the CRT path.	ghidra + rizin
495	0x005ad12d	199	__setenvp	startup	cdecl	inferred	ghidra-headless	4	Builds the process envp array by counting environment strings and splitting name/value entries around '='.	ghidra + rizin
496	0x005ad360	162	startup_build_argv	startup	cdecl	inferred	ghidra-headless	3	Initializes the multibyte table and uses a two-pass helper to count and copy argv entries from the process command line.	ghidra + rizin
497	0x005ad402	290	___crtGetEnvironmentStringsA	startup	cdecl	inferred	ghidra-headless	4	Copies the Windows environment block into CRT-owned storage before envp construction.	ghidra + rizin